WorldPay Module version 2.0 - Support thread

Good Morning,

This is the new support thread for WorldPay version 2.0 the old thread was 44 pages long and covered bugs that have all been solved over the last 4 years or by this release as well as security flaws that have now been fixed.

Version 2.0 has been completely revamped and has many extras and additional security and debugging features such as:

• There is now a new page in the admin section which you get to by clicking on Customers > WorldPayments
• This new page logs all WorldPay responses including cancelled transactions (and what was in the shopping cart)
• It shows whether thetransactions were in test mode or Live.
• It breaks down each WorldPay response, showing if there is a mismatch in the billing address registered to the credit card and the billing address supplied to your shop.
• If the transaction was sucessful it links back to the order.
• The order is now filled out with any warning messages (the customer does not see this)
• Order emails also include any WorldPay Warning or Caution messages (not to the customer)

temporarily the file is available at

http://exploitingit.co.uk/WorldPay_ZC1.3.x_v2.0.zip

this is the standard version that will shortly be available from the Free Software Add-Ons section. There will be another release based on the same codebase called SBD (secure by default). The version above is designed for backwards compatibility and should not stop a live shop working. The SDB version will only be enabled if all security features are turned on.

Thank you
Philip Clarke.

The latest version is available here:

http://exploitingit.co.uk/WorldPay_ZC1.3.x_v2.01.zip

after a stupid mistake (of my own) was found in the new HTML instructions, where people could not see http://<wpdisplay item="MC_callback">. People reading the text file instructions would not have found this error.

Philip.

Hi Philip,

I am still not getting the callback after I pay or cancel from worldpay. I have installed the latest 2.01. It just stays on the thank you page. Please Help!

Thank you.

abbas1:

Hi Philip,

I am still not getting the callback after I pay or cancel from worldpay. I have installed the latest 2.01. It just stays on the thank you page. Please Help!

Thank you.

This is the debug procedure.

a) turn on debugging in Admin and add your email address.
b) do a test transaction.
c) look at any emails you get from worldpay to see if you have any with the subject "Callback Failure Alert From WorldPay"

now in the case of
a) not working and there being no email (check spam folders too), then worldpay is not talking to your server, either firewall, or the http://http://<wpdisplay item="MC_callback"> is not correct.
If you have c) then worldpay has gone somewhere, just not to the correct page.
If in
c) there is a message 302 then you have been sent to the hacker page, so look at youe debug email for the word callbackPW and check that it is sending the correct password through.

If it is sending the correct password through to the correct page, and you are receiving the debug emails from your store, Then in WorldPay, the test side of the site may need to be saved to production or vice versa.

Of course the other thing that could be happening is that you don't have a worldpay account, in which case why are you installing the module :cry:

Thanks
Philip.

Hi Philip,

Thanks for the info, but I realised it was my mistake. The whole website was password protected, hence the authentication was failing. This caused the callback failure.

On another note, I would like to thank you for the worldpay module and all your efforts.

abbas1:

Hi Philip,

Thanks for the info, but I realised it was my mistake. The whole website was password protected, hence the authentication was failing. This caused the callback failure.

On another note, I would like to thank you for the worldpay module and all your efforts.

That's quite alright for the mistake (I've done it myself many times, over the last few weeks).

Thank you for the thanks, consider installing the Secure by Default (SBD) version which will be added this week, it will have version checking so that if there is ever an exploit, it can notify the shop owner with the need to upgrade. It is GPL but won't be available from here as it disables itself if the module is insecure (lack of passwords, MD5 etc...) during installation (not if an exploit is found though) which would break a "live shop", it's for the more experienced user rather than someone looking to plug the original exploits I found.

Has admin > customer >worldpay payments worked for you ? in the previous versions people were concerned that someone may use a fake credit card at worldpay after having filled out their billing details in the shop, and the previous versions discarded the worldpay information.

Philip.

Just to say Philip is a coding genuis - my world pay module is running like a dream.

My call back was not working and it fell to the old classic - "world pay not configured at the clients side" error.

Just to say a MASSIVE THANK YOU! for the time Philip spent looking at this and trying to solve an issue - which was nothing to do with his code.

Genius!

I too am having the same problem with callback.
I have the latest copy of Zencart and the latest copy of WorldPay module. (WorldPay_ZC1.3.x_v2.01)
I do get the Callback Failure Alert From WorldPay (302)
I have enabled the debugging email.
I have check that it is sending the correct password through and this is where I have got stuck.
There is no mention of the word callbackPW or the password its self in the debug email?

Can any one help me?

Paul J Thomas

leisurering:

I too am having the same problem with callback.
I have the latest copy of Zencart and the latest copy of WorldPay module. (WorldPay_ZC1.3.x_v2.01)
I do get the Callback Failure Alert From WorldPay (302)
I have enabled the debugging email.
I have check that it is sending the correct password through and this is where I have got stuck.
There is no mention of the word callbackPW or the password its self in the debug email?

Can any one help me?

Paul J Thomas

Yes what does the first line of the debug email say ?

That you are receving an email is a good thing as at least wroldpay is trying to talk to your shop.

Philip.

Upgraded world pay module to new version 2.01 and everything went fine. Received my first order with the new module and received this message in the new order confirmation email from my cart:

WorldPay has issued a WARNING for this transaction
go to Admin _ Customers _ Worldpay Payments WP#4

When i go into the Worldpay Payments it shows that everything passed and there are no warnings. Everything matched. Any ideas?

Since this only shows on my end i'm not concerned with this little glitch i can live with it :D Just wondered if it was an easy fix.

827 4 xxxxxxxxxx Xxxx Xxxxxx
United Kingdom
None Issued GBP 10.34


Orders

Worldpay Transaction Id: xxxxxxxxxx
(appears in subject line of emails)

AVS Code: xxxx
Card Verification Value check:
(the 3 digit number of on the back): matched
Postcode check: matched
Address check: matched
Country check: matched

Original Order Country: United Kingdom
Credit Card Country: United Kingdom
Countries Match

Order Total: GBP 10.34
WorldPay Authorised Total: GBP 10.34
Totals Match

Original Billing Address: xxxxx
xxxxxx
xxxxxxxxxx
WorldPay CC Address: xxxxxxx
xxxxxx
xxxxxxxxx
Addresses Match

Original Billing Postcode: xxxx xxx
WorldPay CC Postcode: xxxx xxx
Postcodes Match

Thanks for all the good work on this module. It has made my life alot easier. :clap:

Okay so the email side is "buggered" and but there's not warning on the admin page or anything like that, ans there's no warning on the order page ?

(Good things I made is to the client doesn't see it huh ?)

I've probably got a true/ false wrong somewhere, it's a bit difficult "testing" since eevry test credit card always issues a warning by default.

Philip.
Paypal donation to [email protected] please, or you can wait for the SBD modules.

philip_clarke:

Okay so the email side is "buggered" and but there's not warning on the admin page or anything like that, ans there's no warning on the order page ?

(Good things I made is to the client doesn't see it huh ?)

I've probably got a true/ false wrong somewhere, it's a bit difficult "testing" since eevry test credit card always issues a warning by default.

Philip.
Paypal donation to [email protected] please, or you can wait for the SBD modules.

Nope no warnings any place else. I checked in the worldpay admin and everything is ok and everything in zencart shows ok so like i said it's just one of those minor bugs i can happily live with :yes: i'm sure it will show itself in time and it will get fixed but it doesn't seem to effect the way anything works and like you said the customer never sees it so were good to go.

Cheers

Y'all Come and see us. http://britishbeefjerky.co.uk

Bigenuf:

Nope no warnings any place else. I checked in the worldpay admin and everything is ok and everything in zencart shows ok so like i said it's just one of those minor bugs i can happily live with :yes: i'm sure it will show itself in time and it will get fixed but it doesn't seem to effect the way anything works and like you said the customer never sees it so were good to go.

Cheers

Y'all Come and see us. http://britishbeefjerky.co.uk

This is bordering on the bizarre, when I created the royal mail modules, some who has a biltong shop tested a beta that accidentally emails me out if someone clicks one button on one page, and they never ever upgraded even after 2 years and postal rate changes every so often I get emails from their customers about delivery charges.

I think I know what I've done, silly mistake really but also it should trigger at all should be fixed now, just have to zip things up.

okay

http://bouncing.org/WorldPay_ZC1.3.x_v2.02.zip

Now that should work if WorldPay is following it's own instructions. The Documentation states that if there is no warning or caution then a value will not be set, but there is a possibility that the value is set to something like "waf.Harmless" in which case, it's going to still email the shop owner.

If it does it again, then just run the debugging (doesn't harm a live site) and look to see if wafMerchMessage exists in the debug email, if it is there then I need to know the value, if it's not I'll need to rty and figure what's setting the email alerts off but not the warning signs on the worldpay page.

Philip.

philip_clarke:

okay

http://bouncing.org/WorldPay_ZC1.3.x_v2.02.zip

Now that should work if WorldPay is following it's own instructions. The Documentation states that if there is no warning or caution then a value will not be set, but there is a possibility that the value is set to something like "waf.Harmless" in which case, it's going to still email the shop owner.

If it does it again, then just run the debugging (doesn't harm a live site) and look to see if wafMerchMessage exists in the debug email, if it is there then I need to know the value, if it's not I'll need to rty and figure what's setting the email alerts off but not the warning signs on the worldpay page.

Philip.

Hi Philip,

Just installed the new 2.02.
I have a dummy account which i use to test the cart. I just checked the order history of the dummy customer and found this :cry:

http://britishbeefjerky.co.uk/images/wp1.jpg

this was generated with a dummy credit card which worldpay suggests using so i would expect the country code to be wrong but now the customer will see any warnings sent to admin. This shows in the customer orders in admin

http://britishbeefjerky.co.uk/images/wp2.jpg

We then used a valid credit card for a purchase and this is the result
This is in the customers account history

http://britishbeefjerky.co.uk/images/wp3.jpg

This is in the zencart customer order
http://britishbeefjerky.co.uk/images/wp4.jpg

This is from the WorldPay Payment Responses page
http://britishbeefjerky.co.uk/images/wp5.jpg

as you can see in the last 2 pics the order and order history both show warnings but the worldpay response says no warnings, everything matches.

Thought i had debug on but didn't. I now have it on and will check for any other messages when i get in the office tomorrow.

Like i said, i'm a happy camper :D just trying to help debug some minor things.

Time for bed 4 a.m. comes early.
Thanks for your attention

There's probably something in the comparison setting off a total mismatch, shouldn't be difficult to debug. The Totals mismatch is actually an additional check perform by this module only. Worldpay has no way of knowing whether the amount it's debiting are the same as was on your website (well that's a big generalisation but it can be true).

There's about 3 different places to compare things, a) for the product email, b) for adding to an order, c) for the new series of pages. Unfortunately as all the sections are different and some work with stored information, and others work with information being posted straight through, it's easy for little bugs to come through (and helpful of you for finding them)

An interesting thing, is that worldpay does not always issue a caution on country mismatches or other things, it's a discretionary system, so I made the decsions to post the data through this end and compare it with what is written in worldpay, just in case for example someone is using a nicked credit card to buy goods. In theory WorldPay could clear that (if the address were okay) and you would be none the wiser. If worldpay flags something up at a later date, you should be able to claim your money back "easier", saying "oi you cleared this" and this is where the goods were delivered too btw. If you were in doubt (becasue of big billing address/ worldpay address, you could delay sending goods by 24 hours, and then you should get a message through from worldpay says "err, that credit card we cleared...."

An interesting thing too. Only since version 2 (maybe 1.03) has zencart sent through the billing address. Prior to this, even though it asked your shoppers for billing details, it would then go ahead and send out their regstration details regardless due to a big omission in the code dating back to about 2004.

http://bouncing.org/WorldPay_ZC1.3.x_v2.03.zip

This is an important update with many thanks to Bigenuf for the screenshots that showed a small possible "customer relations" problem. Here's the changelog:

v2.03 - Important Upgrade - New feature requires remove and install.
5 November 2008

New Discreet feature added. Although WorldPay warnings were being mailed to the store owner, the customer was never supposed to be able to see these. Unfortunately they appear on the customer's ::My Account:: page. Now one can choose whether to be "Discreet" and not let the customer know if any warnings were issued. Many thanks to Bigenuf for providing screenshots

Fixed bug where incoming payment values were being treated as a string not as a number so falsely setting off a "Payment Value Mismatch" warning.

Fixed bug on country matching, this may still be a "known issue" in the USA because WorldPay provides the country information as "United States" whereas Zencart stores the country as "United States of America"

Please note that these updates are not historical, once an order is generated one cannot remove the comments. (This is for legal reasons, e.g. your business had a registered address on an order in 2007 changed in 2008, the law states that the invoice/ order must not change after it has been issued, so an order is "fixed" with only additional comments being allowed).

Bigenuf has found an important issue which I will write a module for. If you have a difficult customer and you write in the comments "This guy is a pain in the B*TT", and don't Notify Customer you would expect the notes to be for your own private viewing, by Bigenuf has shown that the "private notes" are visible to the customer in ::my accounts::

I have created a discreet mode for this payment module, so that you are still notified by email (twice) if worldpay issues a caution or a warning, you can still check country/ postcode matches on the WorldPay Payments page, but by default you are now "discreet" in that the details do not appear on the orders unless you want to.

Unfortunately this module does NOT and cannot backdate comments on orders.

I will create a new module to enable a discreet mode on global order comments (that I may be able to backdate), so that you can write "this customer is a pain..." and then they won't be able to see it. I personally know that I once wrote "Possible Fraud" against one customer after repeated problems with delivery, so I will address this as soon as possible, bearing in mind that on November 7th I may be having keyhole surgery if I am "fit" enough.

Philip.

I installed the new version 2.03 early this morning. I've had a few orders since then but none with any worldpay warnings. Everything looks spot on but will have to wait until a warning is issued to see that it fully works:D.

Once again thanks for the great work.

I have been working through a "discreet" system now for marking up orders, that will be global with an "Internal Office Display Only" setting, so that people wil be able to safely write memos and their customers. I'll then have to make a decision as to whether I should remove the discreet mode in this module and insist on installing the other one (which is better as it sorts out all other modules too, if any others want to write the code in).

The current text on the orders page is confusing, where it says "Append Comments" it actually means Append comments to the customer notification email if you have chosen to send on out, but the comments are still going to appear here and on the client's ::my account:: pages.

I have got it working! don’t use caps in your WP passwords, just use lowercase and its working fine. Thanks for this thread its been a great help!