WorldPay Module version 2.0 - Support thread

[philip_clarke]

Tick Tock Tick Tock

It's a bomb.

I've thrown this together.....

And helped invent the perfect way that enables RBSworldpay to help you con people out of money (what a great banking organisation, no wonder there's cockney rhyming slang for Merchant banker)!

If one takes your code and swaps the pages, so that the cancel page is the success page...

then generates a random shopping cart number and post the shopping cart information back (with a click to continue button), RBSworldpay will charge again.

The RBSworldpay system makes the assumption that the shopping cart will be submitted once and that it's unique, so randomise the cart Id and con away. This way you could set up a loop.

Customer buys something, RBSworldpay says it's cancelled, customer pays again, it won't stop till the customer is bored. Of course the cunning fraudster could do all kinds of things too, like "add a bit" to the invoice, or change the address to a random one. (to stop worldpay immediately querying six duplicate transactions for each customer). Loop only once, and then show the completed transaction. Time it right and "the con" could go on for about 30 days before doing a runner with the money.

Naturally you send out the client's first order so that they think everything worked, and your client is going to complain to "you" first of all. With a little randomisation it would be possible to only refund the people that "complained", some people wouldn't notice, and keep "the con" running much longer, "of course you don't know why worldpay keeps on charging your customers twice".

For the ones you "said" you refunded would have to wait for their next CC statement anyway, so in the majority that's almost 60 days of conning.

Hold on. Weren't these XSS measures supposed to make it more difficult to carry out fraud ? Not Easier

Anyway, great stuff Bigenuf, if RBSworldpay continues to be stupid, I'll include it as compulsory in the module, probably with a shop logo, since the current default's going to fall to pieces anyway.

Philip.

[Bigenuf]

I've always been told if i Actually knew what i was doing i would be dangerous Glad i could help.

[philip_clarke]

I've always been told if i Actually knew what i was doing i would be dangerous Glad i could help.

My wife thinks the greatest compliment I ever received was in a PM...

You have the mind of a criminal, thank God you're on our side

[kristina150]

Title: ALERT: PayPal Direct Payment Error (10565 <!-- -->)
Content: 10565 Merchant country unsupported. - The merchant country is not supported.

This is an urgent matter. Above is the junk mail we received for many times in several e-mail of our companies, and that's all for the mail. We don't know either which site of our company it came from or which person. And we received e-mails from somebody complaining they had tried so many times to buy things from our sites but failed that they had to give up and buy from others.

Wonder what the matter is and what should we do. If anybody can help, we'll appreciate it very much.

[Bigenuf]

Since this little package i threw together seems to show people how they can con the system i will not be sending it out to anyone else. Disregard my previous post where i offered to send it out. Philip is the exception

Cheers,

Lake aka Bigenuf

[philip_clarke]

Title: ALERT: PayPal Direct Payment Error (10565 <!-- -->)
Content: 10565 Merchant country unsupported. - The merchant country is not supported.

This is an urgent matter. Above is the junk mail we received for many times in several e-mail of our companies, and that's all for the mail. We don't know either which site of our company it came from or which person. And we received e-mails from somebody complaining they had tried so many times to buy things from our sites but failed that they had to give up and buy from others.

Wonder what the matter is and what should we do. If anybody can help, we'll appreciate it very much.

Why is this being posted on the WorldPay thread when it's either a ZC core issue or a PayPal Direct Issue ? Probably a good place to start would be finding the right thread, second thing would be finding out which country was causing the error, and it's not urgent for us and you're not paying for this service.

[robsnowden]

I have just installed Worldpay module on zencart 1.3.6 site and I am getting the following message when going to payment page.

Fatal error: Call to undefined method payment::in_special_checkout() in /home/MYSITE/public_html/shop/includes/templates/template_default/templates/tpl_checkout_payment_default.php on line 40

Any ideas please how to fix this?

Cheers

Rob

[philip_clarke]

Since this little package i threw together seems to show people how they can con the system i will not be sending it out to anyone else. Disregard my previous post where i offered to send it out. Philip is the exception

Cheers,

Lake aka Bigenuf

I really will include it, except I'll de RBS brand it (you'd probably not be allowed to have a page that could be mistaken for RBS on your website, I believe the term is "fraud") and use the ZC constants to link in a shop logo. "The con" exists regardless, I've explained to RBS that they are pillocks and that their anti-xss methods don't stop it. It's a part of their fundamental structure where they pull the page in rather than re-directing, as it's a lot more difficult to pull off the con if the URL in the browser window was "http://www.example.com" instead of "https://secure.rbsworldpay.com" (or whatever they've changed the damn thing to again).

What's that I hear ? the distant sound of the criminal community scrambling to sign for Merchant accounts.

Your code is sound, a good idea and is the only current alternative to have a really screwed up shop. The Con, well that's "their problem", hold on isn't that what they told us ? oh the irony.

[philip_clarke]

I have just installed Worldpay module on zencart 1.3.6 site and I am getting the following message when going to payment page.

Fatal error: Call to undefined method payment::in_special_checkout() in /home/MYSITE/public_html/shop/includes/templates/template_default/templates/tpl_checkout_payment_default.php on line 40

Any ideas please how to fix this?

Cheers

Rob

Upgrade to 1.3.8 NOT a facetious comment,

in_special_checkout

is part of the paypalwpp.php and paypaldp.php packages too and doesn't exist in 1.3.6

[robsnowden]

Hi Philip

Not taken as such - thanks! However my clients has so many mods that this may not be a sure fire success very quickly.

Is there any way to uninstall your mod for now? or is there an old version for 1.3.6 that I can use for now to get site back up and running?

Rob