Offline Order Processing

[D-man]

I need to customize Zen Cart to send each order along with encrypted credit card information to a file so my clients current inventory control and order processing application process the order and the credit card.

On the Zen Cart side the idea is to allow the order to continue if a valid credit card number is used at check out. Then write the order details and cc info to a file for offline processing.

Any ideas where to start to mod Zen Cart to send each order and cc info to a file?

Thanks in advance!

D

[haredo]

Have you read similiar thread below on this page about this issue?

[D-man]

I read many posts - which one are you referring to?

[Kim]

... You and your clients should probably read this - https://www.pcisecuritystandards.org...ce%20Guide.pdf

[D-man]

Thanks for the link. My client has a PCI validated system. They would like to change from the current custom website/shopping cart to using Zen Cart.

What I am trying to research is how/where I can get order details, encrypt the credit card information and send the all the information to the client's current order processing application at the time the order is made.

Your comments are appreciated.

[DrByte]

Please describe your clien'ts current order processing application system which you wish to have handle the data. How does *it* submit the transactions?

[D-man]

I don't have the details regarding how the current website sends oder info to the order processing application. I do know that I will need to send the order, the customer information and encrypted credit card info from Zen Cart to the order processing application. The details regarding the interface form Zen Cart to the order processing application will get worked out as soon as I can determine how to get order details out of Zen Cart.

So, I am asking if anyone can offer some information as to collecting this information from Zen Cart such as similar modules any other knowledge someone could pass along -

[DrByte]

I asked the question for a reason.

Most likely their existing system interfaces with an online gateway service, and the Zen Cart site could most likely be configured to talk to that same gateway directly, thus avoiding all the complexities and security risks of passing credit card data back and forth to your internal systems. Indeed you'll probably find that your client's merchant account TOS requires this, and if they discovered you were passing data via your own means into some internal system they'd probably shut them down in a flash.
There are a large number of available addons for a broad selection of known payment gateways. It'd be worth your while investigating which one would work directly with the gateway your client is actually using.

However, if you wish to write your own bespoke card encryption processing engine and provide guarantees of PA-DSS compliance for all of that coding to your client so that if they encounter a breach or a 6-digit fine you'll pay it for them, you're certainly welcome to do so.

But I submit that you're treading into dangerous turf by tackling it in the wrong direction.

[D-man]

I appreciate your comments and concerns about what I am asking.
The current shopping cart does not use an online gateway service. The order information is sent to a binary file, the credit card info is encrypted and the order processing application and inventory control application use the file to process the order - which does process the credit card with a gateway service. Further, the entire system has been verified by the PCI Security Standards Council as being PCI Compliant with their guidelines.

Now with that being said, would anyone be interested in answering the following:

Where would be a good place to start to collect order information so I may send that information to another system?

[D-man]

Any suggestions?