WorldPay Module version 2.0 - Support thread

[Some Bloke]

Hi all,

I've been lurking here for quite a while now.

I'm not too good with coding and scraped through by trial and error so I'm not going to be a great help but I have a couple of points:

My store's been running over 2 years and I didn't upgrade to Philip's newer WorldPay module - it is still using the old url's to their servers rather than the rbs versions. Strangely the shop still seems to be functioning fine although I do have the whitelisting set to off. Customers come back and continue navigating correctly. And no feedback with complaints. I've no idea why I've escaped but maybe someone can see a clue or direction to work towards?

I know I'll need to change very soon but I'm waiting until the very last until all the stupid changes are finalised.

Petelutonuk - I've got "The book". I had a quick look through and it might have a bit of help for your unusual situation.

In Admin>Configuration>Customer details, there are two separate options (about lines 12 and 13 on my setup)

Customer shop status
Customer approval status

I believe changing these options should work for you

In particular "Customer approval status" has a choice "may browse but cannot see prices until authorised"

Best of luck hope it does the trick.

Cheers

Dave Clarke (no - definitely no relation to Philip)

[philip_clarke]

Hi all,

I've been lurking here for quite a while now.

I'm not too good with coding and scraped through by trial and error so I'm not going to be a great help but I have a couple of points:

My store's been running over 2 years and I didn't upgrade to Philip's newer WorldPay module - it is still using the old url's to their servers rather than the rbs versions. Strangely the shop still seems to be functioning fine although I do have the whitelisting set to off. Customers come back and continue navigating correctly. And no feedback with complaints. I've no idea why I've escaped but maybe someone can see a clue or direction to work towards?

I know I'll need to change very soon but I'm waiting until the very last until all the stupid changes are finalised.

You'd better not publish the location of your shop. The reason why version 2 of the module was created is because it's possible to fool your shop into believing that items have been paid for and approved by worldpay with the first version of the module. It's also possible to discount items by knocking of xx% amount where worldpay would then also send you items have been paid emails, and unless you check every amount it's very easy to execute fraud.

Philip.

[Some Bloke]

You'd better not publish the location of your shop. The reason why version 2 of the module was created is because it's possible to fool your shop into believing that items have been paid for and approved by worldpay with the first version of the module. It's also possible to discount items by knocking of xx% amount where worldpay would then also send you items have been paid emails, and unless you check every amount it's very easy to execute fraud.

Philip.

Thanks for that Philip, I didn't realise it was quite that bad. In my situation (I sell very few items and price adjustments would stand out very clearly) I feel less worried about the second scenario but the first one sounds pretty scarey.

Would worldpay's payment confirmation email be tricked as well (I always check that the shop's and Worldpay's email payments agree)

i.e. would it be ok to wait a week or two for the complete solution or should I treat it as an emergency.

Nice to see you back.

Dave

[philip_clarke]

The chances of someone doing this to your shop are small, not because it's not possible, but because the user base is not that large and the criminal community never paid that much attention. The worldpay email can be faked very easily to say that payment's been made and the details that a criminal would need would all be on your shop. If you don't want to upgrade then I suggest that with each order you log onto worldpay to confirm each order and that the order has taken place.

Philip.

[Some Bloke]

The chances of someone doing this to your shop are small, not because it's not possible, but because the user base is not that large and the criminal community never paid that much attention. The worldpay email can be faked very easily to say that payment's been made and the details that a criminal would need would all be on your shop. If you don't want to upgrade then I suggest that with each order you log onto worldpay to confirm each order and that the order has taken place.

Philip.

Hi Philip,

Thanks for the clarification.

Do you think there is any link between my apparent lack of problems (with visual rendering etc.) due to still using their old servers or is it just co-incidence. I'm a bit worried about making changes that might need several tweaks - I'd rather do the whole thing in one go and get it over with.

Cheers

Dave

[philip_clarke]

Hi Philip,

Thanks for the clarification.

Do you think there is any link between my apparent lack of problems (with visual rendering etc.) due to still using their old servers or is it just co-incidence. I'm a bit worried about making changes that might need several tweaks - I'd rather do the whole thing in one go and get it over with.

Cheers

Dave

The old servers were supposed to be turned off and could be at any time. There was a message about it some time ago, this year we're are on the third location for their servers where the module has had to be altered, so at the moment you are running on a machine that shouldn't be there and could be turned off at any time plus since they appear not to be applying the whitelisting rules to that machine (as you have no rendering problems) I wouldn't be surprised if everything just disappeared one day since they did give a long notice period.

On the plus point, WorldPay didn't break the zen cart that badly, the Romanian Hacker Unu, who recently got into an argument with them, also found that the modifications caused a sql injection vulnerability in one cart (fastcart, never heard of it myself), which is detailed here

http://unu1234567.baywords.com/2009/09/12/fastcart-co-uk-sql-injection/

and that might be the reason why there are legacy machines still out there, yep, use freecart, worldpay upgrades, and allows a hacker to attack your shop and steal the other customer's data, now that is an upgrade policy and a half.

Philip

[philip_clarke]

Anyway I think I'm off now, Wilt's (hello) looking at this thread so I'm probably flagged and I can't see any thing outstanding that suggests that the module isn't working. The script tag's not going to work so css menus are out, and the SSL warnings will vary from computer to computer depedning on what your customers are using so everyone's going to need to buy a certificate. (the other option would be me hosting the stylesheets on my secure server on a per person basis) I wouldn't recommend using a cheap certificate as you'll find that if you pay godaddy then you get a subdomain like your_shop.godaddy.com which can cause further problems and has been dcoumented on other parts of the forum.

The only issue with getting a certificate yourself will be your website hosting company installing it if you are using budget hosting, for which they'll probabbly charge a hefty fee for restarting apache.

bye
Philip.

[Some Bloke]

plus since they appear not to be applying the whitelisting rules to that machine (as you have no rendering problems)
Philip

Sorry, should have mentioned that I do get problems with whitelisting turned on.

The whole thing is quite tentative then. Looks like a lot of blissfully ignorant shop owners could come unstuck fairly soon.

Dave