Skip to content

Validate payment password

CheckPaymentPWD answers whether a candidate payment password matches the value currently stored for the loaded user. It underpins Enforce payment password uniqueness, which negates this result as its first uniqueness check.

Field Value
Operation ID OP-SU-09
Trigger Caller calls clsSystemUser.CheckPaymentPWD(inPaymentPwd)
Inputs inPaymentPwd — the candidate payment password
Outputs Boolean match result
Primary components clsSystemUser.CheckPaymentPWD(...), clsSecureEncrypt.EncryptString(...)
Entry point Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb

Steps

  1. Encrypt the candidate value. CheckPaymentPWD calls clsSecureEncrypt.EncryptString(inPaymentPwd) (BR-011).
  2. clsSecureEncrypt is provided by the SAIFEncrypt.dll internal local binary; its internal encryption implementation is opaque to this library.*
  3. Compare against the stored value. The encrypted candidate is compared directly (=) to PaymentPWD, a property that reads m_DirUser.MiddleName — the AD attribute used to store the payment password's encrypted form (BR-011).
  4. Return the match result. isValid is set to the comparison result and returned; the plaintext candidate itself is never compared directly to any stored value.

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Caller calls CheckPaymentPWD]) --> Encrypt[Encrypt candidate via clsSecureEncrypt.EncryptString]
    Encrypt --> Compare[Compare to stored PaymentPWD - MiddleName attribute]
    Compare --> Return([Return Boolean match result])

Failure and edge-case behavior

  • Because the comparison is encrypted-to-encrypted, a change in the encryption algorithm or key used by clsSecureEncrypt would silently break all existing stored comparisons; no such migration logic exists in this method.*
  • The method relies on m_DirUser already being loaded; calling it before a user context is established would compare against whatever MiddleName value is present (or fail if m_DirUser is Nothing).*

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

  • Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb