ePDQ module for v1.5.0

[zedmick]

I have just installed the latest version (Dec 2012) of Barclay's ePDQ payment interface, you can get the updated Zen Cart payment module by asking the ePDQ support team. They provide it purely "as is" ie unsupported. It seems to have been developed for version 1.3.9 but works ok with v1.5.0, there are a few issues which might cause some headaches-

1. ePDQ expects the monetary amount to be charged to the credit/debit card without a decimal point (ie in pence). The Zen module does this by multiplying the total order amount by 100, which assumes there are no fractions of a penny. You may have fractions if your shipping is a percentage of the order total - the order confirmation pages automatically round up to display the amounts, but when the data is passed to ePDQ you'll see the message

"amount too long or not numeric" or "amount not a number"

because you have a decimal point in the amount. I added a round() function on the order total amount to fix this.

2. I don't know if its just my installation but if a customer has not provided a telephone number in their account the ePDQ module fails with the message:

"unknown order/1/s"

Something to do with the SHASIGN data check on the ePDQ side of things (telephone number is not marked as mandatory but it seems to be). I added some code to default the phone number to 0 if none has been supplied to fix this.

3. You will not get ePDQ to work if the URL calling it includes the ZENID parameter eg if using a shared SSL certificate (you will probably see error "unknown order/1/r"). EPDQ needs a consistent URL to call it.

Perhaps this info will help someone else.
Mick

[Redspan]

Thanks Mark. This has been useful information to me.

I have installed and I'm now at the testing stage. I'm stuck on your third point:

3. You will not get ePDQ to work if the URL calling it includes the ZENID parameter eg if using a shared SSL certificate (you will probably see error "unknown order/1/r"). EPDQ needs a consistent URL to call it.

My test account does contain a phone number but I get "unknown order/1/r"

Any ideas how I can resolve it? Are you saying that I need to remove or disable to SSL cert in order for ePDQ to work?

Thanks :-)

[zedmick]

Any ideas how I can resolve it? Are you saying that I need to remove or disable to SSL cert in order for ePDQ to work?

Our ePDQ runs fine in a full SSL environment ie we bought an SSL certificate for the domain, the problem I found earlier was using a shared SSL certificate in a testing environment.

With shared SSL Zencart calls the ePDQ module with a variable token (zenid) in the URL and it needs to be called with a fixed URL I guess for security.

In your ePDQ technical settings for "Data and origin verification -> URL of the merchant page containing the payment form that will call the page:orderstandard.asp" make sure the URL is correct. Ours is the https domain followed by

/index.php?main_page=checkout_confirmation

If you are running with a shared certificate you will need to purchase a full SSL certificate for your domain unless you can strip the zenid out of the URL before calling ePDQ. I think the general advice is its better to not use shared SSL with Zencart for a live website.

Cheers,
Mick

[Redspan]

I'm fairly sure my SSL cert is for the domain. I've tested both the site and checked the account where the cert is registered and everything is in order. There's no mention of it being shared and it refers to the domain itself.

I've checked that are of the settings you mentioned and it's all correct, and the SHA IN and OUT match correctly.

I've got ePDQ support to raise a ticket....

[zedmick]

Sounds an odd problem - error "unknown order/1/r" is listed only as a mismatch between the calling URL and what you have configured in your ePDQ tech settings. If your SSL domain looks like https://<your_domain> then its not shared. The "zenid" token can show up in the URL for various reasons, search in the forum for more info.

I found it useful to see exactly what was being called and the parameters being passed - in a Chrome browser run through an order checkout, at step 2 of 3 right click the "Continue Checkout" button and choose "Inspect element". The "action" setting on the form named "checkout_payment" should match your "Data and origin verification -> URL of the merchant page containing the payment form that will call the page:orderstandard.asp" setting.

If you do "Inspect element" on the "Confirm the order" button at step 3 of 3 you see the call to ePDQ and the parameters being passed.

Support was helpful but quite slow, I hope they can sort it for you.
Cheers,
Mick

[Redspan]

Well that got me one step closer!

I did as you suggested and the data passed includes http:// not https://, so once I'd amended the epdq settings I got to the card information screen. The amount of the transaction was there where before it was missing.

I see the test info that Barclaycard provide includes card numbers but no expiry or CSV number, so I've yet to find out how to finish the test but I expect a call to them will resolve that.

Isn't it a bit of security risk that anyone can view these same details?

[DrByte]

I see the test info that Barclaycard provide includes card numbers but no expiry or CSV number, so I've yet to find out how to finish the test

It's very common that the use of "test" card numbers can be coincided with "any future date" and "any 3-digit number" for expiry/CVV respectively. Some systems use specific dates and specific CVV values to trigger a specific error response in test mode, but it should be safe to start with something like that.

[Redspan]

You're quite right DrByte, 01/2013 and 123 work fine. Should've tried that at least - thanks!

Now, testing Visa and Mastercard with amounts and card numbers, each payment is authorised and I see the 'return to site' button.

Only trouble is, when I'm returned to the site the message is "Please accept our apologies. There has been an error in processing your payment, please try again."

Is this normal for tests?

[DrByte]

Is this normal for tests?

Probably not.
You'll have to work with your gateway tech staff on that.

[Redspan]

Probably not.
You'll have to work with your gateway tech staff on that.

You mean ePDQ support? I have a ticket open.

I guest the problem lies with my own site because these test ePDQ orders aren't showing up in the Orders section of the ZC admin area.

I know orders work with PayPal as the site has successfully processed such an order, but wouldn't test ePDQ orders get listed (to be deleted after the tests conclude)?