WorldPay Module version 2.0 - Support thread

[Ooba_Scott]

Thanks for taht Philip......i did have a go yesterday, but my brain was frazzled and i didnt get very far......im feeling more awake today so may give it a go if i geta free minute.

I have already located the file in the template_default and i havnt changed it in my override system so thats easy to find and change.

Bit of a busy day at the office today so may have to leave it till tommorow

Not really expecting a response from worldpay unless i constantly phone them..

But will keep you all posted on my findings and all

[philip_clarke]

It is ironic that if the changes made are to stop potential xss warnings, that I have to suggest using my xss knowledge to circumvent the issue. I doubt the javascript one would trigger an issue since it is similar in stucture to google analytics.

[Ooba_Scott]

Philip, Just spotted acouple of things in the /includes/modules/payment/worldpay.php file that i would like to double check are correct if thats ok

On line 33 it points says 'includes/templates/template_default/templates/tpl_wpcallback_default.php' but that file isnt located in template_default for me, it is in my custom overrides folder.....is that an issue?

Secondly on line 75 the address it points to is https://secure-test.wp3.rbsworldpay.com/wcc/purchase, but the web address i end up on is https://secure-test.wp3.rbsworldpay.com/wcc/card

Could they be causing a problem?

[petelutonuk]

Hello Philip. My brain hurts. I tried various things like hard coding the base href tag in and putting little messages in html_header.php (which did pass through) but Worldpay ARE definitely filtering out the base href tag due to the new security standards. They say that until the 30th September 2009 you can disable the "Enable whitelisting?" setting in your Worldpay Installation Administration page. I did this and BINGO the "Thank you" and "Order Cancelled" pages display properly... the base href tag is there in the source code. I tried looking at the various sites they point you to for information (www.owasp.org and www.pcisecuritystandards.org) but I got a bit bewildered. I have sent an email to [email protected] (because their stupid contact form doesn't work!) I have explained what the problem is and that it will become a big problem unless they can provide a solution. Something needs to be done or we simply can't use Worldpay with Zencart I imagine.

[Ooba_Scott]

petelutonuk, you obviously had a better phonecall with worldpay than i did....my tech support person was not very technical at all.

I had a look at rbs site again and found the page about the cahnges and about switching off whitelisting for the time being.....so that will solve the problem for like a month.

But by the end of september it will be back to not displaying the pages properly, due to XSS (i belive this is what philip was thinking they were doing earlier)

Heres the to the page on worldpay http://www.rbsworldpay.com/support/b...s&sub=xss&c=UK

When the whitelisting (safe attribute thing) gets enforced on 30th sep, its going to cause alot of problems, with us zen cart users, and i would imagine alot of other people aswel!

[petelutonuk]

Hi, I didn't actually speak to anyone at Worldpay but tried what they said in the emails and all my sites worked including the one I have had for 8 years which is simple XHTML with a php search engine... even that will be going to hell in a hand cart at the end of September. I haven't actually found a list of the permitted code we are allowed to use....I am starting to despair! I just hope they reply with some useful information A.S.A.P.

[petelutonuk]

Well I got my first email response from RBSWorldpay at 1AM. They asked me if it was just the images and stylesheet that were missing which I confirmed. I received this reply....

By uploading your images and CSS (I have yet to test this) to our WorldPay server via our "Payment Page Editor" through our Merchant Administration Interface should solves the display problem. To reference them, the code is as follows:<img src="/i/XXXX/filename.extension"> (XXXX refers to your installation id)

Please note that your CSS file extension should be in lower caps (eg styles.css instead of styles.CSS). All filenames uploaded to WorldPay server are case sensitive, so if the filename is Mylogo.jpg, on your XHTML file it should points to Mylogo.jpg instead of mylogo.jpg.

Please do not hesitate to contact us should you require our further assistance or clarification.

This looks like a lot of hassle to me and as you can see he has not even tried it, I am not convinced this will work because of the way Zen cart works and would mean the site is not all under the control of the Zencart admin section. I will try uploading a few things to my worldpay installation this evening after work.