Ceon Manual Card 2.2.2

[Forum5]

Server OS: Linux 2.6.x
PHP version: 5.26 (Zend 2.2.0)
MySQL 5.0.9x
Zen Cart 1.3.9d Fresh Install

Add-on: Ceon Manual Card 2.2.2

The credit card used was MC 4111111111111111 12/12

The invoice copy that was emailed to the customer and the email that was sent to the Admin did not contain the leading four (4) digits.

Billing Address
------------------------------------------------------
Firstname LastName
Panoramaweg 1
7551 Stegersbach
Austria

Payment Method
------------------------------------------------------
Credit/Debit Card

MasterCard XXXXXXXX1111

On the screen checkout (3 of 3) the leading four digits are displayed properly as '4111'.
On the Invoice copy found in <Admin>, <Customers>, <Orders>, order # 207115-blah, the leading four digits of the credit card are present.

Why are the leading four digits truncated in the emails?

I do not know if this is a Zen Cart email rendering or Ceon.

This is a manual cc process. I can't go to Admin to retrieve the leading four digits on every transaction.

Where can I start looking? I am in the process of uploading fresh code now. But I don't have high hopes there.

[Forum5]

Well, now i'm sure it's Zen-Cart.

At "root/MyZen-Cart/includes/classes/order.php" you will find the following code at about line 990

 $cc_num_display = (isset($this->info['cc_number']) && $this->info['cc_number'] != '') ? /*substr($this->info['cc_number'], 0, 4) . */ str_repeat('X', (strlen($this->info['cc_number']) - 8)) . substr($this->info['cc_number'], -4) . "\n\n" : ''; 

Simply remove the comment markers around this piece of code in the line above

/*substr($this->info['cc_number'], 0, 4) . */ 

and the four (4) digit prefix will be then be displayed on the order.

Now, I wonder why so many people read this post and didn't respond?
Surely there are many out there smarter than me.

[sonik_fury]

Thanks for taking the time to solve this, I just edited my order.php file as well. Definitely will save time

[conor]

Hi,

Why are the leading four digits truncated in the emails?

Because it would be GROSS NEGLIGENCE to have all the details in an e-mail.

This is a manual cc process. I can't go to Admin to retrieve the leading four digits on every transaction

If the security of your customer's card details is so unimportant to you then you really shouldn't shouldn't be running an online store.

I hope you never get your e-mail hacked or you'll be paying thousands of pounds/dollars in fines for breaking the law/terms and conditions of your merchant account.

For anyone else reading:

NO ONE SHOULD SEND MORE CARD NUMBER INFORMATION BY E-MAIL THAN IS ALREADY PRESENT IN THE E-MAILS GENERATED BY CEON MANUAL CARD. Do NOT apply the above change!

All the best..

Conor
ceon

[Forum5]

Conor,

I certainly appreciate the work you have done on the Ceon Manual Card module. I have installed it on a couple of sites and my customers like the way it works.

I will not participate in a Forum Spat however, as for your concerns, they are a bit off the mark, to wit;

Because it would be GROSS NEGLIGENCE to have all the details in an e-mail.

I have never said, "have all details in an email"

.......customer's card details is so unimportant to you then you really shouldn't shouldn't be running an online store.

I have never said the card details were unimportant to me and I do not run a store and never have.

I have installed dozens of stores for others with multiple payment options. A couple of them (having done joint business for over 10 years with them) have asked for the change due to the regulation changes of 2010 and the recent upgrades by ZC.

I have registered the companies with Merchant service providers and told my customers the pit falls of modifying the code. I assured them that I would speak openly and honestly with any Merchant Service Provider about their account. Which I have done.

.......or you'll be paying thousands of pounds/dollars in fines for breaking the law/terms and conditions of your merchant account.

After reading the Merchant Terms and talking to the Merchant Service Provider about their terms, the conclusion is this, "by the Letter of the Terms/Law" there is no violation when the middle digits are missing. I will agree that "by the Intent of the Terms/Law" it is a little gray. The Merchant Service Provider regulations are still evolving. It is probably a matter of time till they tighten up more.

For anyone else reading:

NO ONE SHOULD SEND MORE CARD NUMBER INFORMATION BY E-MAIL THAN IS ALREADY PRESENT IN THE E-MAILS GENERATED BY CEON MANUAL CARD. Do NOT apply the above change!

All the best..

Conor
ceon

I appreciate your concerns however the customer has elected to make the changes, has been notified of the risks and accepted the risks which are recorded via archived email.

I am sure that the first time their Merchant Service Provider clears their throat I will get a call to change it back or make some other modification.

As with most regulations, the door is not slammed shut on implementation day. It takes a while for everyone to adjust their business model. I'm sure there are many who have not fully implemented the 2010 CC Merchant regulations.


Thanks again for your Ceon Manual Card.

[conor]

Hi,

I will not participate in a Forum Spat however, as for your concerns, they are a bit off the mark, to wit;

You've gotten me wrong, there is no spat, I posted what I did for the protection of others, to advise them against the ramifications of the changes you suggested, I bear no ill feelings towards you.

I have never said, "have all details in an email"

No, you've said send the entire number in "in two e-mails", so if someone's e-mail account has been hacked the complete number can be constructed easily from the two e-mails.

Ceon Manual Card already uses a very unsecure process, that brings things to an even more unsecure level, simply to assuage a client's laziness.

I have never said the card details were unimportant to me and I do not run a store and never have.

Fair enough, I thought this was for you.

I'd advise you to revert the changes you made and advise your client that laziness is not a good enough excuse for mishandling customer's card details in this way.

After reading the Merchant Terms and talking to the Merchant Service Provider about their terms, the conclusion is this, "by the Letter of the Terms/Law" there is no violation when the middle digits are missing

Yes but Ceon manual Card preceeds that e-mail with an e-mail with the middle digits! :)

Thanks again for your Ceon Manual Card.

Glad you like it.

You can of course modify things to work whatever way you like but one person has since modified their Zen Cart, based on your suggestions, and may not have understood the ramifications of this, so I felt I had to post for other people's sake.

It is of course up to everyone individually to choose how they want to do things, we're all free thankfully!

It's best to be aware of the reasons the software works the way it does in the first place though!

To be honest, the suggested code I would make is to remove the entire credit card number from the order e-mail (as in remove the middle digits AND the last 4 digits! :) ).

Have a nice weekend!

All the best..

Conor
ceon

[jimh3768]

Hello,

Having a great deal is issues with CEON. When an order is placed, the email is not being sent.
We are not being notified and thus, missing some numbers from the credit card.

Please help.
Jim

[Forum5]

Hello, Having a great deal is issues with CEON. When an order is placed, the email is not being sent.
We are not being notified and thus, missing some numbers from the credit card. Jim

I have been using Ceon for years and don't remember ever having Ceon email problems. Make sure you have entered a viable email address in the Ceon setup. Create a dummy account and dummy products in your store. Use the test credit card number to make several test purchases.

I'm not sure it Ceon uses the store's mail handler or one of it's own but check the store smtp handler @ <StoreAdmin>, select <Configuration> <E-Mail Options>