Ceon Manual/Offline Card Payment Module v1.0.0!

[conor]

Hi,

It gives me great pleasure to release the first version of our Manual/Offline Card payment module for Zen Cart!

This Payment Module provides everything a Zen Cart shop owner needs to accept Credit/Debit Card payments over the internet for inputting into a Manual/Offline Card Processing System.


Full details about the contribution are available at its website:

Information and Downloads - http://dev.ceon.net/web/zen-cart/ceon_manual_card


I recommend that you take a look at the above site but for those who want more information first (lazy you :) ), here is the feature list:


Features

This Payment Module has been written to be as comprehensive as possible (despite the limited nature of a payment module for Manual Card Processing). The current feature list follows.

Support for many Card Types

Each card type can be enabled or disabled at the click of a button inside the admin. Cards currently supported:

• Visa
• Mastercard
• Switch/UK Maestro
• Visa Delta
• Solo
• American Express
• Visa Electron - UKE
• Diners Club International
• JCB

Please Note: If you would like additional card types added, please just ask us. It's not difficult for us to add more (mostly we need need to know details like “Are Start Dates required/optional/not used?” etc.).


Allows gathering of the following information:

o Card Holder's Name
o Card Type
o Card Number
o Expiry Date
o CVV Code
o Start Date (Switch/UK Maestro/Solo/American Express Only)
o Issue Number (Switch/UK Maestro/Solo Only)

Please Note: The CVV code and middle digits of the credit/debit card number are sent in an e-mail to the store owner. This means that the full details don't need to be stored on the server and is by far the most secure way to collect Card Details for manual/offline processing. The rest of the details can be accessed at all times through the "Orders" section of the Admin.


Retains entered Card Details right throughout the checkout process.

If a user goes back to change their Shipping Address, or realises at the Confirmation Stage of the checkout procedure that they have entered some incorrect information, when they return to the Payment Page the card details they entered previously will be automatically restored. This prevents any frustration with customers having to re-type details and should help prevent customers leaving at the last hurdle! Please note: If your server has PEAR:Crypt_Blowfish installed, this information is kept encrypted in the session so as to protect the confidentiality of the details!


Visual Validation Feedback using JavascriptVisual Feedback of Javascript Validation.

In order to catch any problems with Card Details entered by the customer as quickly and easily as possible, this module will not only alert the user to any incorrect information when they attempt to submit the form, it will actually highlight the form fields which require their attention. Again this should help to reduce customers getting frustrated and leaving at the last hurdle!

Icons for each Credit Card accepted.

If you enable the option in the admin, icons are displayed for each credit/debit card accepted (see picture at right). Maybe not an essential feature, but it does look more professional for your shop!


Ability to disable Autocomplete.

Some browsers store credit/debit card numbers and/or CVV numbers entered and automatically insert them in a card number field/CVV field when a user returns to a website. This can be quite disconcerting to customers so the option to have this browser feature disabled is offered (and set by default) by the Ceon Manual Card payment module.


Dynamic Start Date and Issue Number support.

Certain cards (Switch/Maestro/Solo/American Express) may need a Start Date to be supplied for authorisation to take place, while certain cards (Switch/Maestro/Solo) also may need an Issue Date to be supplied. This module dynamically displays the necessary form gadgets to capture this information from the user based on the cards types enabled in the admin.


Debug Support.

Sometimes there can be problems with a shop's server settings. The debug mode allows you to see what information was to be sent and the server setup (encryption settings) identified so you can check your settings. Most people should never need this though and it is subsequently disabled by default.


Complete support for Zen Cart 1.3.x's Observer/Notification System.

There are two versions of this module, one of which makes full use of Zen Cart 1.3.x's handy new notification system to make installation even more of a breeze!


Enjoy!

Please read the documentation before posting any questions in this thread so that we can hopefully keep the number of posts here down to a minimum!

Download NOW!

If you like this contribution and get a lot of use out of it, please consider making a donation!

All the best...

Conor
ceon

[conor]

Hi,

Forgot to post a screenshot of the Javascript Validation Visual Feedback, so here it is... (also, it's "Maestro" and not "UK Maestro", there isn't any difference anymore! :) )





If you like/use this module please let us know (or even better, donate! )

All the best...

Conor
ceon

[Brent]

.......

Please Note: The CVV code and middle digits of the credit/debit card number are sent in an e-mail to the store owner. This means that the full details don't need to be stored on the server and is by far the most secure way to collect Card Details for manual/offline processing. The rest of the details can be accessed at all times through the "Orders" section of the Admin.....

Hi Conor,

Just a thought. If you have the Email Archiving mod installed will these emails then be archived in your database therefore leaving a security hole?

Regards

Brent

[Ryk]

Hi Conor,

Just a thought. If you have the Email Archiving mod installed will these emails then be archived in your database therefore leaving a security hole?

Regards

Brent

If it does, then surely that also applies to the existing ZC cc module?

[conor]

Hi Brent,

I love your questions sometimes... you really think about things from a strong security perspective... as a result they really benefit everyone!

I'm happy to say that this module sends the e-mails as "cc_middle_digs" so Zen Cart doesn't archive them. The e-mail sent to the e-mail address as specified in the module's configuration is the ONLY way to get the middle digits and the CVV number.

It also has a message at the bottom of it (in capitals!) which reminds the user to delete the e-mail once they've charged the card.

Tried to make this one 100% secure from the start, but it's great to have someone asking important questions as a backup!

All the best...

Conor
ceon

[Pixxi]

Hi Conor,

Thanks for making this available

Just installed to test and getting a 'cannot redeclare' conflict with your Protx mod (Protx mod installed but not turned on in admin):

Fatal error: Cannot redeclare file_exists_in_include_path() 

(previously declared in /[path to file]/admin/includes/functions/extra_functions/ceon_manual_card_functions_file_system.php:28)

in /[path to file]/includes/functions/extra_functions/protx_direct_functions_file_system.php on line 27 

[Pixxi]

Cancel that report - for anyone reading who has the same error, the solution is to upgrade to v 2.04 of the Protx mod which includes a check to see if that function has already been declared previously by this mod

[conor]

Hi Pixxi,

Glad you like the module!

I was going to say you must have an older version of our protx_direct module but you beat me to it, thanks!

I introduced the check for the existence of that particular function in version 2.0.3 of the protx_direct module so anyone with that version need not upgrade to 2.0.4 if they don't want to (as not much has changed between those two versions)... upgrading won't do any harm of course though! :)

All the best...

Conor
ceon

[Vger]

to accept Credit/Debit Card payments over the internet for inputting into a Manual/Offline Card Processing System.

Allows gathering of the following information:

o Card Holder's Name
o Card Type
o Card Number
o Expiry Date
o CVV Code
o Start Date (Switch/UK Maestro/Solo/American Express Only)
o Issue Number (Switch/UK Maestro/Solo Only)

Please Note: The CVV code and middle digits of the credit/debit card number are sent in an e-mail to the store owner. This means that the full details don't need to be stored on the server and is by far the most secure way to collect Card Details for manual/offline processing. The rest of the details can be accessed at all times through the "Orders" section of the Admin.

Okay, let's get this straight. In most cases collecting information online and then running it through an EPOS terminal in an offfline 'bricks and mortar' shop will put the shop owner in violation of the agreement they have entered into with Mastercard/Visa. You can end up with a visit to your shop, your EPOS terminal ripped out and be blacklisted for life from using thir services again.

Secondly, under current UK legislation and under Mastercard/Visa T's and C's you are not allowed to store credit card information in an online environment unless:
1. The card details are stored on a separate server, used only for that purpose, and which can only be accessed by the ip address of the store collecting the information.
2. The company storing the data will have to submit to an annual security audit, carried out by trained industry professionals experienced in security audits (the cost will run into 000's of pounds a year.

This is why, in the UK at least, the use of Credit Card modules on websites, to collect card data for manual processing, is a thing of the past.

In the case of a complaint from a customer about a fraudulent transaction on their card from a website collecting and storing card details the hosting company can end up with that whole server being seized.

Vger

[Ryk]

That is quite a bold statement - can you supply references to the relevant documentation to back it up?