WorldPay Module version 2.0 - Support thread

Tick Tock Tick Tock

It's a bomb.

Quote:

---

Originally Posted by Bigenuf

I've thrown this together.....

---

And helped invent the perfect way that enables RBSworldpay to help you con people out of money (what a great banking organisation, no wonder there's cockney rhyming slang for Merchant banker)!

If one takes your code and swaps the pages, so that the cancel page is the success page...

then generates a random shopping cart number and post the shopping cart information back (with a click to continue button), RBSworldpay will charge again.

The RBSworldpay system makes the assumption that the shopping cart will be submitted once and that it's unique, so randomise the cart Id and con away. This way you could set up a loop.

Customer buys something, RBSworldpay says it's cancelled, customer pays again, it won't stop till the customer is bored. Of course the cunning fraudster could do all kinds of things too, like "add a bit" to the invoice, or change the address to a random one. (to stop worldpay immediately querying six duplicate transactions for each customer). Loop only once, and then show the completed transaction. Time it right and "the con" could go on for about 30 days before doing a runner with the money.

Naturally you send out the client's first order so that they think everything worked, and your client is going to complain to "you" first of all. With a little randomisation it would be possible to only refund the people that "complained", some people wouldn't notice, and keep "the con" running much longer, "of course you don't know why worldpay keeps on charging your customers twice".

For the ones you "said" you refunded would have to wait for their next CC statement anyway, so in the majority that's almost 60 days of conning.

Hold on. Weren't these XSS measures supposed to make it more difficult to carry out fraud ? Not Easier:oops:

Anyway, great stuff Bigenuf, if RBSworldpay continues to be stupid, I'll include it as compulsory in the module, probably with a shop logo, since the current default's going to fall to pieces anyway.

Philip.

I've always been told if i Actually knew what i was doing i would be dangerous :cool: Glad i could help.

Quote:

---

Originally Posted by Bigenuf

I've always been told if i Actually knew what i was doing i would be dangerous :cool: Glad i could help.

---

My wife thinks the greatest compliment I ever received was in a PM...

Quote:

---

You have the mind of a criminal, thank God you're on our side

---

Title: ALERT: PayPal Direct Payment Error (10565 <!-- -->)
Content: 10565 Merchant country unsupported. - The merchant country is not supported.

This is an urgent matter. Above is the junk mail we received for many times in several e-mail of our companies, and that's all for the mail. We don't know either which site of our company it came from or which person. And we received e-mails from somebody complaining they had tried so many times to buy things from our sites but failed that they had to give up and buy from others.

Wonder what the matter is and what should we do. If anybody can help, we'll appreciate it very much.

:oops:

Since this little package i threw together seems to show people how they can con the system i will not be sending it out to anyone else. Disregard my previous post where i offered to send it out. Philip is the exception :clap:

Cheers,

Lake aka Bigenuf

Quote:

---

Originally Posted by kristina150

Title: ALERT: PayPal Direct Payment Error (10565 <!-- -->)
Content: 10565 Merchant country unsupported. - The merchant country is not supported.

This is an urgent matter. Above is the junk mail we received for many times in several e-mail of our companies, and that's all for the mail. We don't know either which site of our company it came from or which person. And we received e-mails from somebody complaining they had tried so many times to buy things from our sites but failed that they had to give up and buy from others.

Wonder what the matter is and what should we do. If anybody can help, we'll appreciate it very much.

---

Why is this being posted on the WorldPay thread when it's either a ZC core issue or a PayPal Direct Issue ? Probably a good place to start would be finding the right thread, second thing would be finding out which country was causing the error, and it's not urgent for us and you're not paying for this service.

I have just installed Worldpay module on zencart 1.3.6 site and I am getting the following message when going to payment page.

Fatal error: Call to undefined method payment::in_special_checkout() in /home/MYSITE/public_html/shop/includes/templates/template_default/templates/tpl_checkout_payment_default.php on line 40

Any ideas please how to fix this?

Cheers

Rob

Quote:

---

Originally Posted by Bigenuf

:oops:

Since this little package i threw together seems to show people how they can con the system i will not be sending it out to anyone else. Disregard my previous post where i offered to send it out. Philip is the exception :clap:

Cheers,

Lake aka Bigenuf

---

I really will include it, except I'll de RBS brand it (you'd probably not be allowed to have a page that could be mistaken for RBS on your website, I believe the term is "fraud") and use the ZC constants to link in a shop logo. "The con" exists regardless, I've explained to RBS that they are pillocks and that their anti-xss methods don't stop it. It's a part of their fundamental structure where they pull the page in rather than re-directing, as it's a lot more difficult to pull off the con if the URL in the browser window was "http://www.example.com" instead of "https://secure.rbsworldpay.com" (or whatever they've changed the damn thing to again).

What's that I hear ? the distant sound of the criminal community scrambling to sign for Merchant accounts.

Your code is sound, a good idea and is the only current alternative to have a really screwed up shop. The Con, well that's "their problem", hold on isn't that what they told us ? oh the irony.

Quote:

---

Originally Posted by robsnowden

I have just installed Worldpay module on zencart 1.3.6 site and I am getting the following message when going to payment page.

Fatal error: Call to undefined method payment::in_special_checkout() in /home/MYSITE/public_html/shop/includes/templates/template_default/templates/tpl_checkout_payment_default.php on line 40

Any ideas please how to fix this?

Cheers

Rob

---

Upgrade to 1.3.8 NOT a facetious comment,

in_special_checkout

is part of the paypalwpp.php and paypaldp.php packages too and doesn't exist in 1.3.6

Hi Philip

Not taken as such - thanks! However my clients has so many mods that this may not be a sure fire success very quickly.

Is there any way to uninstall your mod for now? or is there an old version for 1.3.6 that I can use for now to get site back up and running?

Rob

Get the old 1.3.6 zip and overwrite the file. then disable the module. Should be the fastest fix.

That's the old Zen Cart 1.3.6 zip not worldpay, any other worldpay that would work on 1.3.6 has a big security hole.

Thanks Philip - this has sorted me out pro-temp!

I will have a crack at upgrading his site to 1.3.8a tonight when site is quiet and then try mod again.

Many thanks for speedy help.

Rob

One of the fourm administrators has been deleting my posts, the last time my posts were edited I left the entire project for 2 years.


Philip.

Quote:

---

Originally Posted by philip_clarke

One of the fourm administrators has been deleting my posts, the last time my posts were edited I left the entire project for 2 years.


Philip.

---

Any reasoning for the edit/delete? Was it the Worldpay thread?

It would appear that the administrators objected to me telling the lazy woman that posted here, that she had an "urgent error" (it wasn't urgent, they apparently have been receiving emails about mistakes in their shop for some time, so it was only Urgent whn someone told her she should have sorted it out) which was nothing to do with worldpay, and I told her to find the right thread (I guess the thread was near the top of the forum list because of recent discsussions), then I told her to search for the right thread and go away after she continued posting.

I have very little tolerance for lazy people that expect me to sort out their problems for free, and shirk responsibility, post in the wrong thread and can't be bothered to search. (hence the contrast un my attitude between that woman and the bloke above with ZC 1.3.6 who got a rapid reply)

Two interesting points.

Within the last hour I received an email from RBS today offering me a developer account. I said it is pointless unless they are going to change the system to stop the kind of fraud I demonstrated (as I'd have to rewrite the module). I also told them that base href has nothing to do with PCI DSS after a client has paid, since PCI DSS is also to do with information leakage on "their" website, not information on a zen cart website.

Second thing, if my posts are edited or deleted again. I will withdraw my copyright on all modules. This is not a joke, it is the only option that an open source developer has and that will revert the WorldPay module back to the stage where it has a great big security hole in it and my royal mail modules will then not exist. The modules will also all need to be re-written if ZC version 2.0 gets released.

Philip.

Well trying to look on the bright side, maybe they, RBS, are taking you seriously now. Was that a pig i just saw fly past my window???

Philip, I think you have been very patient, I can feel your frustration and I wish I had your knowledge. Please don't leave us just as Worldpay seem to be taking notice. With your persuasion perhaps they will cooperate and we wont all have to bodge our sites or cancel our Worldpay accounts.

I have a bigger problem right now...found out by chance last Thursday that the company whos products I sell on my website are banning anyone from displaying prices on their websites from October 1st... unless the customers are logged in. OK, I can do this with Zencart but I cannot design a complete working site in 2 weeks around my full time job and I have only just started. :yuck:

I guess this forum should be used to help sort problems between us, I pray that this big problem will be sorted out A.S.A.P. Peter.:smile:

Oh I doubt it, I fully expect RBS not to do anything until someone commits a large scale fraud multiple times over, they'll bury it the first time or two until it becaomes common place and then they'll do something truly bizarre. I know (in great detail from a senior civil servant about an exact ongoing scam) that the banks routinely write off fraud rather than fix the system, as it would cost more to fix apparently, but then they are way over quoted on price all of the time and seem to require 5 times the people to do a one person job.

I've no idea if they've fixed the XSS exploits from the 1st September either, I'll probably pop back next week, at which point they will have been charged several thousand pounds to alter one line of code, just to check. I'm just not really interested any more, after having been ignored for so long, it is almost impossible for me to summon any more desire to work on a gateway that brings no rewards fiscal or otherwise.

Philip.

Quote:

---

Originally Posted by petelutonuk

I have a bigger problem right now...found out by chance last Thursday that the company whos products I sell on my website are banning anyone from displaying prices on their websites from October 1st... unless the customers are logged in.

---

Shouldn't be that tricky, I'll do some research.

Sorry incorrect post

Quote:

---

Originally Posted by petelutonuk

I have a bigger problem right now...found out by chance last Thursday that the company whos products I sell on my website are banning anyone from displaying prices on their websites from October 1st... unless the customers are logged in.

---

in the file includes/functions/functions_prices.php

there is a function zen_get_products_display_price.

At the bottom, if you alter the return value to only display a price if the user is logged in, then you'll have done it.

(hence why I'm a £80+ an hours developer, because it saves you a lot of money and time).

Quote:

---

Originally Posted by Electrobumps

I've installed the Module, all the options appear in Zencart.

However when I try and activate them they go to the amber light. Not green.

I get the message about updating postage costs, but can I actually try out this add on without paying for the postage costs to be updated?

Am I doing something wrong?

I'm happy to do this if I like the way it integrates with my site and feel in is beneficial.

---

Are you talking about a different module ? as opposed to the worldpay payment module ?

Worldpay want me to release a patch. I have explained to them that different people use different templates and that I can't patch every template.

EDIT:

So that would be worldpay wanting me to work for free, too.

Quote them your going rate and i'm sure you would be alot more cost effective then who they use now and get it done alot faster. They should hire you as a consultant. Well worth the money in my opinion. I'm sure they have alot of their tech stuff farmed out overseas.

I'd only be interested in a directorship nowadays, it's a lot better use of my time to tell managers what to do and decide the policy from a knowledgable position, but unfortunately I didn't go to the correct school, university, army regiment, political party, or sit on the board of a failed company.... Hold on, aren't we in a recession because of board members that went to the correct school, university, army regiment, political party, or sat on the board of a failed company ? Ah, I'm starting to see a pattern there.

Yep that's right. It's not what you know but who you know.
I dare say i never even made it that far.
Self taught and dangerous:rolleyes:

I've been having a play around with a program. IF RBSworldpay go against all the recommendations and continue to remove the base href tag when they make made white-listing compulsory, I believe I can fix each shop on on a shop by shop basis. I think it will take about 45 minutes and will require ftp and admin access plus the shop will need to closed down for that period of time. The alternatives are:

• Give up worldpay
• Recode all of the links yourself
• Pay a freelancer an hourly rate to recode them
• ermmm...

Basically if work is not done, then the payment pages after received funds will fall to pieces as show on the preceeding pages. It can't be built into the module because everyone uses different templates. Because I know the system, I've written a small diagnostic program that would enable me to target any system but would still involve me doing it by hand. I believe that I could do this faster than anyone else. (and without buggering anything else up)

If RBSWorldPay do pay attention and leave the base href tag in, then this work will not be necessary. You should also note that if your template is reliant on javascript for anything, mouse effects, menus, page counter, pop up images... then these items will never work on the end page at worldpay's website as they'll never allow a script tag through, although thsi shoudl not be that much of a problem as the current end page for the worldpay template doesn't display any "you might be interested in these items.... kind of page that could have required a pop up".

Also anything like the end of list items or option tags that may currently be "damaged" by worldpay's actions cannot be fixed, as there is a big difference between me running a program that can go through your templating system and at http:// etc... to all the links, images, style sheets etc... and worldpay ripping a section of your webiste out (which is what they are doing with the <base> and end tags for </li> and </option>).

Philip.

What alot of people don't take into consideration is that there are thousands of carts out there that this will effect.
Not just zencart carts.
Anyone using the callback will have problems.
Most people will not see the effects of this until a shopper tells them their pages are a mess or the confirmation email they and the customer receives is a jumbled mess. This is caused by the lack of a css stylesheet because worldpay rips the link out. The carts will still work but customers will lose confidence in you and your site when it's a mess thus losing customers.

Most people don't have the skills to even attempt to fix this problem and if you hire someone, other then Philip, to fix the problem it will take them hours if not days to figure out what to do.

The domino effect will soon be in force and worldpay will be the ultimate loser but then again don't we own a majority of RBS? So it's our money they are wasting even if we don't use worldpay the British taxpayer will once again pay for incompetence.

Well i'm lucky at this point because i know how to fix my site but anyone else i would urge to contact Philip if they need a fix otherwise we wait until D-Day and see if the forum gets swamped with this problem. I would also urge anyone with a worldpay account to complain to them in the strongest manor.
This is not a zencart or module problem it is a problem that worldpay has conceived themselves. They haven't thought through the ramifications of their actions or lack theirof.

Too early to get on a soap box i'm getting dizzy.

Cheers, Lake

I was one of the first to spot this impending catastophy in July / early August. I have been watching the posts and sending my own communications to Worldpay here and there.
Today I have received another weak response saying that they are still working on the problem...as if we didn't know!
I have re-iterated the problem and stated that if they go ahead and filter the base href tag, I and hundreds more will be cancelling our Worldpay accounts and going to other merchants, which there are plenty of and that will work with Zencart and that as far as I can see, seem to be cheaper.

I have not got the time, the knowledge or the money to pay anyone else to sort the problem out. I am also now wondering whether Zencart is actually a good idea, at least if you buy a product it would be up to them to bring out modifications as they would have the incentive to do it. Like Philip said, he gets no reward from doing this, let alone all the hassle with this forum alone. I think the whole world is going to hell in a hand cart.:frusty:

Hi Guys, sorry i havnt been active on this thread recently, work has been manic.

I have fixed my worldpay callback pages, by using aboslute URL's and removing the left/right hand columns (as they contain images), and also removing the footer as this also has an image.

I personally think this looks fine for me and im happy to have it like that.

I just now need to remember to replicate it on a new clients zen shop as he also has worldpay :( and he was unaware of all these changes happening at worldpay end

I just need to make sure i remember what changes i have made etc haha.

Phillip just gotta say i think you are doing a grand job as always!

I estimate that there are at least 1000 shops using RBSWorldPay as their primary gateway, based on the number of downloads and that some of the downloaders are designers re-using their code.

@bigenuf - the appeal of zen cart is that there are a lot of people who do it themselves, they also have very outdated carts and are sitting ducks with the recent security exploits, there are some DIYer's that PHP/HTML wise, are as skilled as the average web designer, and then theres are developers. Designers' nice chaps, can do things I can't like design things to look pretty, most have a very limited knowledge of PHP structure let alone the more complex Object Orientated things. I get sub contracted quite a bit because of this. The better DIYer may be able to put something together, what concerns me is that a lot of people have had their site designed, so will go back to the "designer" who then might try and do it themselves, spend a lot of time and the client's money etc..

Actually I should have stuck a big sign in admin saying "check the forum first" but the designer's would probably remove it.

Then they'll be the people that try and get a cheap option off some freelance websites, which IMO is really quite dangerous because of the lack of knowledge or reputation I once was asked to look at something while a team from an Eastern European country were working on the same website, the team were explicitly told they couldn't have database access but had just read the config file and appeared to be downloading email addresses presumably to sell off as spam, while someone else was uploading illegal films. This isn't saying that there aren't trustworthy people in the Eastern European countries, but if they are offering a really low price they may be making money elsewhere like by selling lists, so reputations have to be checked very carefully.

I do break into websites including banks and governments, I also use my own name and don't hide anything I've done. I'm more of a strategist than a hacker as I do it to show what could be done, like poison the UK or commit relatively simple frauds, and mostly the results are that the internet is a safer place, unless of course you get WorldPay ignoring everything.

@peltonuk - Out of the open source shops, ZC is the most secure, osCommerce, the parent is now so full of holes with little maintenance that in parts of the site you only have to hit the enter key to commit fraud. The issue is that by usnig a base href tags, template designers didn't need that much PHP code, they didn't need to work out for each image whether the server has in the HTTPS or HTTP side (because if you ######## that up IE gives an insecure item warning) and that led to more flexibility as more lower skilled people could access the project from the start and grow to be better developers. The "problem" with commercial shops is the License agreement, which tends to go, "it's not our fault", so even if this comes up, then they don't have an incentive to fix it and they would charge. Also then there is the issue of contacting the shop owners, a lot of shops are installed by designers, shop owners then up paying middle men.

A cracking example is that there is one zen cart approved host that a) I had to tell them how to configure their server because they don't come from a systems' admin background, b) they are charging £75 to unzip and ftp in my royal mail modules. Every few months someone finds this out and emails me, but because it's open source I can't stop it.

Anyway everything would be better if the base href tag was kept in, they are allowing external style sheets too, there are attack vectors based on that also, in fact I can't work out any logical reason why they are picking on that tag. I think that they probably should have employed someone to RTFM before they decided on these decisions, for one thing they are using the specification that is listed as

Quote:

---

Example policy file (far too permissive for production use)

---

I think that paypal charges about £20 a month for a virtual terminal service as well as the other features that WorldPay operates, the only thing they don't do is have a real terminal like you would swipe your card through in a shop, which I think you can extend the option with RBS, but if HSBC were to do a partnership then (or Google were to buy a physical bank which would be a good tactic since their checkout has never really taken off) ... actually I can't think of a reason why one would want to stay with worldpay even if they were to leave the base tag in, can anyone ?

Quote:

---

Originally Posted by Ooba_Scott

I just need to make sure i remember what changes i have made etc haha.

Phillip just gotta say i think you are doing a grand job as always!

---

Ha, what job, I'm just waiting, If they leave the tag in, then this whole discussion's been for nothing but I may just close the module anyway as I can't think of a reason to leave it running. When ZC 2.0 comes along the module would have to be re-written anyway.

If they don't leave the module in, I expect I'll get one or two sites repaired while a lot of people leave worldpay when they find out what has happened, or those people will get ripped off and charged far too much money for a repair to their website.

Want a competition ? I reckon I can fix the pages in 45 minutes on your client's website, that the pages will never throw an error and look identical to how they were before and include all images (my test program identifies the key points in the entire site :smartalec: ), no it's not really fair is it ? :D

Quote:

---

Originally Posted by philip_clarke

they are charging £75 to unzip and ftp in my royal mail modules. Every few months someone finds this out and emails me, but because it's open source I can't stop it.

---

If you're talking about who I think you are, then there is a very clear statement on every product page that the fee is NOT for the module but for the installation and configuration.

haha no i think you would beat me to it......

Gotta update the client to the latest version of ZC, and patches and your latest module release as their previous guys havnt been keeping it uptodate

Have got a question, which you could probably answer me straight away....

Why do we need the base href tag anyway?
If you remove the base href tag, then the site will work fine anyway (obviously not in worldpay, as it needs it to be absolute urls), but on a general ZC site you dont need it surely?

Yes I believe there is, although I doubt many people ask what "installation" entails or "configuration". e.g

"We unzip a file and click an "e" for each module then "install"

Except that I don't think they click the "e" part as it's up to the client to choose and configure the charges for the service.

so that's 5 minutes work at £75, £900 per hour. Or 2 minutes work £2,250 per hour.

Quote:

---

Originally Posted by Ooba_Scott

haha no i think you would beat me to it......

Gotta update the client to the latest version of ZC, and patches and your latest module release as their previous guys havnt been keeping it uptodate

Have got a question, which you could probably answer me straight away....

Why do we need the base href tag anyway?
If you remove the base href tag, then the site will work fine anyway (obviously not in worldpay, as it needs it to be absolute urls), but on a general ZC site you dont need it surely?

---

It depends "normally" on a ZC site it wouldn't be needed.

Occasionally you have some strange mod_rewrite rules.

Very very occasionally you have a linked in stylesheet that has an image in it, or includes other stylesheets. If one wanted to extend Zencart by using jQuery themes, then it would be very beneficial as the themes are built from one core file that needs to know where everything is, and css files only put in one request per item, whereas php could go "well if it's not there, then try...."

For the majority, you are correct, then you get the person that redirects their site from http://www.example.com/ using mod_rewrite incorrectly to http://www.example.com/store/index.php and the images are looking for http://www.example.com/ (because the URL hasn't got the store bit in it) when they are supposed to be finding them in http://www.example.com/store/ putting the base href at http://www.example.com/store/ stops that

Quote:

---

Originally Posted by Ryk

If you're talking about who I think you are, then there is a very clear statement on every product page that the fee is NOT for the module but for the installation and configuration.

---

Look its' you, and your website

http://www.jsweb.co.uk/big-royal-mail-p-129.html

and this is what you write to make things "clear"

Quote:

---

We remind you that the fee we charge is for installation and configuration of the module; where a module is a commercial offering, that fact, along with the cost of the module itself, will be made clear and we will also supply a link to the origin of that module in case you wish to purchase directly from the supplier.

Most of the free modules are available on the Zen Cart website.

---

Which makes it look like the module isn't free, might be commercial, and that the provided link is so they can buy it from someone else (probably me, except they can't because I don't charge for it). And I know I've never received a contribution or donation from you. At £2000 per hour, christ you're miserly.

Quote:

---

Our 14 day money back guarantee (applicable to annual accounts only)

---

is illegal too, check the trading standards rules for distance selling.

Quote:

---

Originally Posted by philip_clarke

Second thing, if my posts are edited or deleted again. I will withdraw my copyright on all modules. This is not a joke, it is the only option that an open source developer has and that will revert the WorldPay module back to the stage where it has a great big security hole in it and my royal mail modules will then not exist. The modules will also all need to be re-written if ZC version 2.0 gets released.

Philip.

---

Philip, while it's obvious that your frustration levels are high because of RBS nonsense, DON'T GO TAKING THAT OUT ON THE MODERATORS HERE!!!!

I've looked into what happened:
One of the moderators was cleaning up the duplicates of the PayPal-related posts that person made in "your" thread. While doing that they also saw your inappropriate choice of words directed at that person, and deleted it. They probably should have slapped you around at the same time for your own unsuitable behaviour. But they decided to be more kind than that.

So, there are 2 options:
a) *you* stop conducting yourself inappropriately to forum users or risk being banned for conduct unbecoming
or
b) allow moderators to do their job in peace

Now, let's just put the attitudes aside and go back to the regular discussion now.

Ban me. Withdraw all modules from the download area that I have authored, revert all modules that I have modified back to their previous state. That's total removal of the parcelforce and royal mail modules and you'll have to contact Alan duncan for the worldpay module to see what edits I did on the co-authorship of this

http://www.zen-cart.com/index.php?ma...oducts_id=1148

since the original module with the exploit appears to have been deleted.

Good Bye.

I think this discussion just closed.

Oh dear, Oh dear. This kind of result proves my question about whether Zencart or any open source software is a good idea. If people get seriously fed up and are relied on, we are all sunk. Personally I was already having a very hard time before the Worldpay issue and on top of that the company I sell products for is now banning the display of prices on websites, I now have 4 whole days to design a working website. Perhaps I should say good bye as well. Why is it this all happens during the worst recession in history... I also think that if any wrapping of knuckles is to be done, it should be done privately and not in a forum. I wish everyone the best of luck.

Well, that is sad. I surely hope this is not the end of it and Philip does not quit on us. I for one, not a programmer, cannot re-code this on my own without proper instructions, also I do not make enough money on my store to be able to pay somebody to re-code this module - but I would hate to go back only to paypal... Unfortunatly for some of us there aren't that manyoptions for merchant accounts - the only one which allowed me to deal in 3 different currencies was WP - even if it is more expensive than other available solutions which offer less functionality. But if there is no other solution I will have to drop WP and try to find someone else after 6 months of having WP account.

It isnt too bad fixing it up to make it work for the time being with the thankyou page and cancellation page, the real problems would begin when worldpay release new updates and security holes that need fixing.


Also when ZC 2 is out, the whole module will need to be re-written anyway as no modules will work correctly

Quote:

---

Originally Posted by Ooba_Scott

Also when ZC 2 is out, the whole module will need to be re-written anyway as no modules will work correctly

---

From what I have been told, ZC 2 will not be compatible with V 1.3.8a anyway (correct me if I am wrong).
Speaking to Philip it does not seem worth keeping the Worldpay module going in it present form even if they allow the base href tag as he exposed other holes in their system that if they fix them, the worldpay module will not work at all. Strange how other merchants don't seem to be having these issues yet they all have to be compliant with the new PCI rules.
:dontgetit

Yeh i think you are correct in the fact that ZC2 will not be compatible with 1.38a as the changes are fairly major......but it does mean every module will need to be re-written to be compatible with v2 (althougth some modules will be made redundant, as i belive some will become standard)


Im not to bothered if WP keeps or remove the base href tag now, as i have fixed up my site to work without it, and the thankyou/cancellation page now looks fine (well as fine as its going to get)
I have made the css stylesheets absolute URL's, and i have turned off the left/right columns and footer so it doesnt try to display images that can not be found.

Yeh i understand what you mean about it is isnt worth keeping the mod if they fix the holes and the mod isnt fixable....that would suck.

Be a hard conversation to have with my clients who already have Wolrdpay accounts :S

I know nothing about these other security holes mentioned but I can't help wondering if when they fix them they will affect all payments from any website and if that happens there would be so many people affected. As I still have 10 months of my annual Worldpay fee to use up I will use this module while I can. If they filter so much that it doesn't work before then, I will demand a portion of my money back. CAN ANYONE TELL ME if it is possible just to send the cart information to Worldpay, like you would with a simple HTML site, so that I can use Worldpays standard "Yes"html payment receipt page?

You can remove the callback <wpdisplay item="MC_callback"> in the worldpay production management area or uncheck the callback i forget which but the problem then as i can remember is that worldpay will not send back the cart info so you will not have a record of the payment unless you go into your worldpay account and even then you won't know exactly what they ordered or what shipping address they might have specified or the mode of shipping they also will not receive a receipt from your cart or an email or even a record of it in their account they can refer back to. They will receive an email from worldpay saying they paid a specified amount to you.
If i'm wrong please someone correct me.

My current HTML site still uses MC_callback. The customer gets a "Thank you" email using a script from the sendmail on my server confirming what they have ordered and I get a detailed email of product codes and prices, delivery address etc. Because of the whitelisting I have set the default Worldpay "Thank you" page to resultY.html (or resultC.html) receipt page. If I could just do this for my Zencart site I would be happy enough.:clap:

If that works for you great. But the only drawback i can see is that you open your shop up to a vulnerability that Philip found where people could send fake orders through your store and it looked like they had paid at worldpay. That was when version 2.0 of this module was born. So i will be just using a template override to compensate for the look of the pages and the security will stay in place as Philip designed it.

I don't know from the various suggestions which is the easiest method to get round the base href filtering (if they do enforce it). I don't want to hard code anything if possible and I don't want to mess up my site and not be able to figure out what went wrong. I guess that is why I back up my site and database every time I make a significant change. Perhaps I should pay Philip (I miss him already :( ) to sort me out...

I would hire Philip if your not sure otherwise,

Look back on page 39 of this thread and you will see how i have done it. Using the method i describe there all you are doing is making an override for the worldpay callback pages, namely the success page and failure or cancelled page. If you use the override then if worldpay do put the href back into the whitlist then just delete the folder and nothing in Philips module has been touched but if they don't put the href in then you can customise those 2 pages using the override and it will not effect any of your other zencart pages. You do have to hard code a couple of url's but nothing too dificult.

Lake

hardcoding the absolute css links is pretty straight forwards and easy and isnt time consuming at all.....but yes hardcoding every image link would be time consuming and hard work and probably easier to pay phillip to do it as he has created a script that will hunt down and the links which would saves hours of your time...

....the other option would be to just not show the side boxes etc so you wouldnt need to hardcode the image links at all.......

This is pretty simple to do aswel, infact bigenuf kindly produced documentation on how to do this back a few pages.

For me this is the simlpest solution and the site still looks pretty decent

Hi Bigenuf and Ooba_Scott, thanks a lot for your help. I shall back everything up then try this. If it all works I will stop throwing my toys out of the pram. :smile: If it doesn't work, brace yourselves!:cry:

will be getting my hard hat ready ready just in case!

But i reckon you will be fine :) i have faith!

Good luck but remember to do a backup first!!

oops sorry bigenuf, you must ahve written your previous post same time as me adn beat me to it :( haha

Damn need to be quicker at typing and stop answering the phone

:smile: This wont start happening till at least 6:30PM BST so you can probably have a peaceful evening.

Attention Please

It appears that the HREF is now in the whitlist in worldpay it is still not catching the close for <li> but the HREF is working could someone else please verify this for me.

Lake

</li> </ul> both work now also but something still isn't right and i can't put my finger on it yet, will do a bit more testing.

As far as i can tell the <base href= tag now works under the Worldpay Whitelist and all the return pages also have the closing tags for </li> and </ul>:clap:

Something is still not right but i can't sus it right now.:cry:

Lake

Hi Bigenuf, yes I enabled whitelist and noticed the "Thank you" page sort of works but is still a mess. I have done what you "designed" and yes it looks a lot better, well done. However...
I can't seem to disable the header etc (as I am not that familiar with php).
The instruction in tpl_main_page.php to uncomment $flag_disable_header = true: <br/> ... Does that mean remove the * if so this does not seem to uncomment it and doesn't work. Am I being a bit thick here?:dontgetit

I thought that in php, // commented things out, what is the * ?
Also on my site I have extra stylesheets that are needed but I do not know how to include them as they are not called up in html_header.php like the other 3 are.
I use the CSS drop down menu module which needs it own stylesheet (I have disabled it for now)
I also have another stylesheet for the Ezpages side boxes....any ideas how I can get these to see their stylesheets....I am getting a little confused.
You never know, all this effort and worldpay might just allow all the tags we need again :clap:

Quote:

---

Originally Posted by petelutonuk

Hi Bigenuf, yes I enabled whitelist and noticed the "Thank you" page sort of works but is still a mess. I have done what you "designed" and yes it looks a lot better, well done. However...
I can't seem to disable the header etc (as I am not that familiar with php).
The instruction in tpl_main_page.php to uncomment $flag_disable_header = true: <br/> ... Does that mean remove the * if so this does not seem to uncomment it and doesn't work. Am I being a bit thick here?:dontgetit

I thought that in php, // commented things out, what is the * ?
Also on my site I have extra stylesheets that are needed but I do not know how to include them as they are not called up in html_header.php like the other 3 are.
I use the CSS drop down menu module which needs it own stylesheet (I have disabled it for now)
I also have another stylesheet for the Ezpages side boxes....any ideas how I can get these to see their stylesheets....I am getting a little confused.
You never know, all this effort and worldpay might just allow all the tags we need again :clap:

---

This is what i used

PHP Code:

---

// the following IF statement can be duplicated/modified as needed to set additional flags
  if (in_array($current_page_base,explode(",",'wp_callback')) ) {
   $flag_disable_right = true;
   $flag_disable_left = true;
//    $flag_disable_footer = true;
//    $flag_disable_header = true;
  } 


---

I have to admit i never tried to uncomment that section as i had this in my page. Give it a try or something similar might be in your page.

You can hard code to any stylesheet using this in the html_header.php

<link rel="stylesheet" type="text/css" href="http://YOURSITE.co.uk/includes/templates/YOUR_TEMPLATE/css/stylesheet.css" />

or the location of the stylesheet.


But it looks like the <base href= works now. Try running a test on your site and see ho it looks.

Lake

rename the override folder in your template folder, the wp_callback folder in order to see what the page looks like without the override since worldpay allow the <base href= now. otherwise it will still try and override it. all side boxes and graphics should work now under worldpay.

Lake

Thanks Bigenuf. I will give that a go later.

On the subject of the tags now appearing to be in the whitelist but pages still looking crap, I did a transaction with it enabled and one with it disabled. I saved the html and used winmerge to compare the files... haven't looked at it all as that would take all night but it seems they are dropping some </div> tags amongst other things.

For example, when my page displays ok about 41 lines down I have this:-
<div class="clearBoth"></div>
<!--eof-navigation display-->
<!--bof-branding display-->
<div id="logoWrapperOuter">

But on the whitelisted attempt I have this :-
<div class="clearBoth" />


<div id="logoWrapperOuter">
(the spaces are where the <!-- --> were)
They are obviously filtering out any comments.
To me it seems like their filter is very flakey.
Perhaps we should just wait till the finish poking about!
No wonder Philip got so hacked off with them.

It appears they are making changes as we speak because a few hours ago the <base href= did not work so we might have to give it 24-48 hours to settle down. I do all my testing on a test site and when i tried my fixed test site it was a mess so i checked to see if the whitelist was enabled in test and it was and when i disabled the override (wp_callback) folder the site looked alsmost exactly like it should with graphics and everything so i tested it on my live site i turned on the whitelist in production and everything looked fine with some small exceptions. I've never installed an override on my main site.

Lake

yes I renamed my template wp_callback folder.
I will keep it there so I can use it if need be.
I am off to bed now, brain cell is frazzled:smile:
And also just discovered I get 7 minutes to edit any mistakes I make when posting in this forum.

hmmm looks like i will be having to test my thankyou pages again! lol

hopefully they will fix the things then leave it at that.....cant afford to keep having to test this site for my client


:)

So I made a test payment tonight with the withelisting enabled. I put the WP module in test mode and processed an order on my credit card. The results aren't that bad - even though there are some overlapping texts - I could live with that for now - if we cannot make it any better.

Please see the picture attached of the hank you page.

It looks like your footer is being displaced you could turn that off for the page but other then that it looks great. I would imagine for whatever reason they are replacing some of the </div> with /> kinda throws things out of whack.

Lake

Returning code from worldpay is inconsistent.

On one line you see:

<div id="navMainWrapper"> <div id="navMain">

and a few lines down you see

<div id="navMainSearch" />

But the closing </div> is there in more places then not.

o dear, i havnt managed to do anymore testing yet, and i somehow doubt i will be able to today. Lots of other things i need to be working on and sorting out :(

But it still seems they have a lot of work to do to, they fix one problem then start by messing other bits up......whats the deal with adding the self closing tag /> at the end of divs lol.........that isnt going to help any issues, that probably worse than not pulling in </options> or </li> tags

Yep worldpay has once again managed to bugger everything up again.....think it looks even worse than it did before.

My client did a test and sent me a screenshot of what it looked like......so annoyed at worlpay.

They are losing so much credibility....they jst cant get anything right

Hi there,

I also got the same problem at worldpay with base tag. I gave absolute urls to make something work.

I have put back the original file with base href tag and the return page is showing as it should be, with complete style, centered etc.

Before i had big font, screen at the left. It's almost perfect now.

Thank you all for pushing worldpay to make it work again.

:clap::clap:

Let's not celebrate too quickly.:no: Lets wait till someone receives communication from them to say they have finished tampering with their filter. Unless it has improved since about 10:30 BST last night, I still have problems.

It hasnt improved petelutonuk.

Still looks like a dogs dinner! Has to be missint some tags or closing tags off early in ordr to make it do what it is doing.....ive had a quick look and havnt seen anything obvious apart form they have decided to self close the nav div.

They wont get back to you unless you contact them....apparently they said they will keep me up to date with changes etc....but that was about 3weeks ago now and not heard a thing unless i have emailed them.

I will be emailing them again when i have figured out what they have messed up this time......as they will never spot it.....i had to point out that they were not pulling in </li> and </option> tags for them.

But cant check anytime soon, got a client meeting in abit.....what a hectic day!

First time i've looked at this thread in a few days. I've just seen Philips last post after DrBytes tough words. DrByte handled that really well...not.
I hope that Philip hasn't left us for good. My world pay still displays ok although i have whitelisting turned off.

On a separate question to people using worldpay. Has anyone chosen the added paypal option through worldpay. Does this work ok through zencart?

It will work fine when white listing is turned off.....but ahve you looked at it when it is turned on

I strongly reccomend you do look at it when it is turned on.....as it will be made compulsory in the near future!

And if you dnt try and fix it now, you could be rushing about trying to fix it when they make it compulsory


Nope havnt tried paypal through worldpay, and there is no way i would now......worldpay are a pile of pants lol

Why not use the paypal option in zencart?

Quote:

---

Originally Posted by Ooba_Scott

It will work fine when white listing is turned off.....but ahve you looked at it when it is turned on

I strongly reccomend you do look at it when it is turned on.....as it will be made compulsory in the near future!

And if you dnt try and fix it now, you could be rushing about trying to fix it when they make it compulsory


Nope havnt tried paypal through worldpay, and there is no way i would now......worldpay are a pile of pants lol

Why not use the paypal option in zencart?

---

Hi Ooba_Scott

I have tried worldpay with white listing is turned on and I know what the thank you and cancel page looks like with white listing on. I've already seen Bigenuf's work-around which seem to work ok for me as i've tried it. I know that Philip was going to try to impliement this work-around to a possible future worldpay mod release which I dought is going to happen now.

Nah i doubt Philip will be re-doing a release....also i believe 3 or 4 pages ago philip said he pointed out alot of security flaws to worldpay, and if they fix them then the module will not work anyway.

Yeh the work-around worked for me until yesterday i think it was (have you had another look recently) as worldpay have made more changes to it, and its throwing everything out of whack again :( think petelutonuk posted a jpg of what he was seeing.... i am seeing something similar

To me when i looked at view source, it seemed like WP were adding self closing tags to some major divs...which is jst silly!


I havnt had time to recheck and try to fix it, its put on the backfoot for this week as i have had lots of other things to do.

But im hoping they will make some more changes soon and fix it

I think the change over date is the 23rd Sept. Is that correct? I'll probably check again this date.

Regarding the paypal through worldpay. The option seems so simple. I was just a little concerned that it could break the mod in some way.

I dunno about the paypal through WP, sorry. The mod may not be geared up to take the paypal part....i woudl have thought the mod would only do WP.

I just wouldnt trust it to be honest, purely as WP have been so bad recently.

I have used the paypal in the zen cart, and all you do is just provide your paypal email address....and thats it.

I guess thats pretty much the same as what WP are offering.



In regards to the change over date, they have pushed it back to Oct 13th now i believe. It is mentioned in this thread recently, but can not remember where abouts.

If anyone used the fix i posted earier in the thread and they turn the whitelisting on then the page will be a mess, either rename the wp_callback folder in your template folder or delete it and your result pages should be 90%+ ok. I just have a minor cosmetic thing to sort out.
From what i can see is that if you hard coded any links to css sheets or anything that would have used the <base href= they now work so some of those things will now duplicate and they conflict. There is a php script in one of the pages to load the right css sheets and prior to this it did not work and now it does.

I reversed my fixes and my page is 98% with whitelisting on the other 2% is due to self closing tages /> on a couple <div> but it doesn't do it on all of the <div> which doesn't make sense.

There are some people out there who will never know this all happened because it will never be noticeable on their pages.:cry:

Thanks for the heads up Bigenuf I've now renamed wp_callback.

The fact that you say your page is now 98% is great news. I'll have to do a check on my site in the next week or so. fingers crossed.

I think i'll take your advice Ooba_Scott about paypal. If the date has been moved to a date in October then more good news. I didn't know that.

Check back on page 40 of this thread and it will give the dates and also a link to the article on the RBS site.

I am very concerned that some people say that with whitelisting enabled, their "Thank page" is 98% ok, mine is still a complete mess!
The main layout framework, top banner section, left, center and right columns are ok but no links show and the worldpay generated receipt information is all on top of itself so you cannot read it. The banner that should be at the bottom of the page is at the top. The basic colour scheme is ok. I'm still waiting....if Worldpay don't sort this by October 1st, thats it, I will go to another merchant. I can't see what they have achieved apart from screwing it up.:no:

Cheers for the heads up the removing the folder bigenuf, i will have to try and action this sometime soon.....will save me lots of time to :)

Im pretty confident mine should work a good 98% aswel

petelutonuk....did you do bigenufs fix? ...if so have you reverted back to what it was before, ie delete/rename the folder?
It sounds to me like bigenufs fix is still there

Yeh bigenuf, i really dont get why they would self close some tags and not others, why would it randomly pick some tags to close!

Yeh some people wont know this is happening because knowone has told them it is happening....i mean my client got an email from WP about changes they were making, but he was unaware it was going to affect him in anyway shape or form. And he never passed the info on to his web development team so they wouldnt have known.....

But hopefully all this will be over soon and WP will have sorted themselves out! .......possibly

Hi Ooba_Scott, yes I did no Bigenufs fix and it worked apart from my CSS drop down menu and the side menu CSS does not get pulled in so looks odd. But I have now renamed the WP override folder and enabled whitelisting and it all goes horribly wrong because of the partial filtering of the div tags I think.

Anyway I have just found out that the company whos products I sell (shall remain nameless for risk of further problems) is not only banning the display of prices on a website but requires that a potential customer contacts me first to speak about the products. I then give them a unique password to access the site to purchase products. It is the most rediculous thing I have come across regarding selling a product. I need to find another range of products to sell and so will hundreds of other people in this particular "Business" when they find they are going to be prosecuted if they don't talk to customers before selling any products! I am absolutely fuming about it. :yuck:

im sorry to hear that mate, sounds like you need to find a new supplier!

and soon

Well I have managed to configure tpl_login_default.php and login.php on my template overrides so that people cannot create an account and log in to see the prices. (isn't that silly but that is how the company want it) They are now directed with a button to the contact page. I have access via a hidden link to the "Create Account" page, I create an account for them and email the password to the new customer. It actually works very well. But will I get any new customers...time will tell. In the mean time we wait for Worldpay to stop messing about... Apologies that this was nothing to do with the Worldpay thread but I feel like my friends are in here. :smile:

Hello all, I have followed the instructions to install WorldPay 2.10 for Zen Cart version 1.3, yet I am having issues.

Customers are able to purchase the products and send money to myself via WorldPay and they receive an email confirming that their payment has been received.

However, in the Admin Control Panel, no orders are shown and this means I do not know if customers have purchased anything, or if I do through Worldpay, I do not know which product etc.

I am using the Admin Control Panel with a SSL certificate, could this be affecting it?

I have re-installed everything today from scratch and this is becoming frustrating now!

Any help or advice is greatly appreciated!

Thanks,
Chris

I have looked through the forums but have not found an answer to this one...
Can someone tell me if there is a way of preventing the browser security message popups after checkout success such as "Do you want to display only the webpage content that was delivered securely" Yes / No.

This happens whether Worldpay whitelisting is on or off.
In IE8, if I say NO to the question, my receipt page displays ok (even with whitelisting turned on) but customers may say YES because it says it may compromise the security of the entire webpage. The receipt page therefore collapses with no formatting. My ISP says there is no point in having the site hosted on a secure server, so I do not understand how to get around this. When I pay online on other sites, this doesn't seem to happen. Help!

Pete, that's likely back to the hardcoded http (stylesheet) URLs you've added to your certain templates to accommodate WorldPay's other bugs.
If you're going to hardcode a URL on an SSL page, you need to use https instead of http.

Quote:

---

Originally Posted by chris_miley

I am using the Admin Control Panel with a SSL certificate, could this be affecting it?

---

1. Login to your WorldPay admin screen (http://www.worldpay.com/admin)

2. In the WorldPay Control Panel screen click 'Configuration Options' for
the installation i.d. Enter the Callback URL exactly as follows (including
case):

https://<wpdisplay item="MC_callback">

N.B. If SSL is not enabled on your website the Callback URL should be:

http://<wpdisplay item="MC_callback">

This might be the problem.

Check http://YOUR_SITE.com/docs/worldpay

for documentation for the module. This is installed when the module is installed.
The documentation is very thorough.

If your not using the callback then your cart is not receiving the order info.



Lake

Thank you DrByte. I still get the security pop up with no hard coded style sheets. Are you saying I need to get an https server certificate or whatever? This is all new to me and I don't really understand it at all.

From what i've seen in the past if you try to load a picture from an http;// source into a page which is https:// you will get a message such as you did. I've been told the only way around that is to host the picture on a secure server which is https://. That is the way we had to do it with paypal a few years ago when we customized the paypal page to look like ours.

So, the Worldpay module will not work properly unless you host the images needed on the receipt page? Seems like just one more hassle I don't need. I think I will quit this and my business, too many rules and regulations now. I am so tempted to name the company whos products I sell to warn everyone else NEVER to get involved in any way, shape or form. I have been doing it for 9 years now and to be told now that I am not allowed to put prices on the website is the last straw. There should be a law against them.

On the SSL issue: https://www.zen-cart.com/tutorials/i...hp?article=150

Whoops I meant to say "does that mean the Worldpay module will not work properly unless you host the images needed on the receipt page on a secure server? Oh well I don't think it matters now, I think it is all too much for me, I just don't have the time and I need my life back. :yuck:

my thankyou poage probably looks 85% ok lol, everything looks out of whack still.....

Only had a quick play yesterday as i had lots of other things to do at work

I did email worldpay again, but as of yet no response.....ahwel.

I shall keep on trying to fix it i guess

It's fixed now. Thank you guys!