WorldPay Module for ZenCartv1.3x

[philip_clarke]

Ahh, now this is where I admit I am flawed since I do not have worldpay access. I advised him to lok through his logs to see if the worldpay java object is attempting communication with his zencart shop (which it wasn't but the advice is still valid).

Thanks Snow-man, for covering the bits that I can't reach.

[duncanad]

Wow - this has been a busy thread.! Glad to see that some are taking note of this module. My apologies for any errors.

I'll try to cover the various points in order:

1. MD5 coding error.

Oooops! Sorry - so that's why I couldn't get it to work. And here was me thinking my host hadn't set up the MD5 functions correctly.
I do apologise - but I did say in the installation notes that I had not tested it. And until now neither had anyone else!

2. To 'SSL' or 'NONSSL'

The following is a quote from the installation notes included with the beta fileset:

4. In the WorldPay admin screen click 'Configuration Options' for the installation i.d. (usually bottom of screen). Enter the Callback URL exactly as follows (including case):

https://<wpdisplay item="MC_callback">

N.B. If SSL is not enabled on your website the Callback URL should be:

http://<wpdisplay item="MC_callback">

Also in /includes/modules/payment/worldpay.php:

Un-comment out lines 134 & 135
Comment out lines 136 & 137

Since these notes were written WorldPay changed the way it handles test and live transaction - they are now directed to separate URLs rather than just relying on the 'Test Mode' value to direct the transactions appropriately. I therefore added the code at lines 53 to 60 to handle this. This moved the rest of the code down so the last two lines of the above should now read:

" Un-comment out lines 140 & 141
Comment out lines 142 & 143"

I think you will find that this works perfectly adequately - although Philip's method is more elegant.

I agree with Philip that it would be better to pick this up automatically but in my defence the default is SSL as this is how it should be configured. What is anyone doing passing customer name and address details insecurely over the internet! I don't make any apologies for making it difficult for someone to do this insecurely.

In any case I have limited time to support this module as it is.

'SSL' is not superfluous as this sets the path to the secure server which may not be the same as the path to the non secure server. The path to the secure server is set in the configure.php file. For some (those with their own security certificate) the two paths will be:

http://www.myserver.com
https://www.myserver.com

but for those using a shared security certificate the paths may well be:

http://www.myserver.com
https://secure.sharedserver.com/www.myserver.com

Just replacing 'http' with 'https' will not work.

3. The Missing $zenId

It's not missing - I deliberately removed it. The session ID is passed to WorldPay as cartId - see lines 124 and 135. WorldPay pass this back along with callback URL. When the $zenId was included in the callback URL it got included twice. Now that is superfluous!

4. Blank Obsolete Files

Now I never thought of that. Good idea - but what about those who are installing the module for the first time? They will end up with a lot of empty files on their server for no reason. I'll give it some thought before the next release.

LASTLY

Basically the module works out of the box if the installation instructions are followed. Don't muck about with the callback URL or try to set anything different from

"https://<wpdisplay item="MC_callback">" or
"http://<wpdisplay item="MC_callback">" if you must (but remember to make the code changes as per the installation instructions).

Implement the security features and welcome your customers to your store.

The most common problem people have is callback failure. My opinion is that this is invariably caused by the host server configuration. Ask your host if they maintain sessions. If they say 'No' or don't know - move to a host that does know and says 'Yes'. I have allowed several people with callback problems to test their sites on my server. In every case the module worked first time.

I hope I have covered everything and that this helps clarify things.

Thanks to all for your comments - especially for pointing out the error to the MD5 code. Obviously there is a need for the module out there or this thread would not be quite so long. It's nice to think that I might have been able to contibute in my own small and flawed way.

Regards to all,

Alan

[philip_clarke]

2. To 'SSL' or 'NONSSL'

The following is a quote from the installation notes included with the beta fileset:

Since these notes were written WorldPay changed the way it handles test and live transaction - they are now directed to separate URLs rather than just relying on the 'Test Mode' value to direct the transactions appropriately. I therefore added the code at lines 53 to 60 to handle this. This moved the rest of the code down so the last two lines of the above should now read:

" Un-comment out lines 140 & 141
Comment out lines 142 & 143"

I think you will find that this works perfectly adequately - although Philip's method is more elegant.

So do I, that was written after the "remove the SSL" comment as I had a gentleman with SSL and NOSSL at differing locations as you exemplify below.

In any case I have limited time to support this module as it is.

Yes I have been up to 2AM every morning helping people with this.

'SSL' is not superfluous as this sets the path to the secure server which may not be the same as the path to the non secure server. The path to the secure server is set in the configure.php file. For some (those with their own security certificate) the two paths will be:

http://www.myserver.com
https://www.myserver.com

but for those using a shared security certificate the paths may well be:

http://www.myserver.com
https://secure.sharedserver.com/www.myserver.com

Just replacing 'http' with 'https' will not work.

As mentioned above that's why I'd be elegant !

3. The Missing $zenId

It's not missing - I deliberately removed it. The session ID is passed to WorldPay as cartId - see lines 124 and 135. WorldPay pass this back along with callback URL. When the $zenId was included in the callback URL it got included twice. Now that is superfluous!

Ah, but the exploitable version also had the cartId as the zenid and yet didn't use it to re-establish the session (it wasn't supposed to) and there wasn't the time to check whether the beta was "working", so quick fixes were made to be 100% sure.

4. Blank Obsolete Files

Now I never thought of that. Good idea - but what about those who are installing the module for the first time? They will end up with a lot of empty files on their server for no reason. I'll give it some thought before the next release.

ZC themselves have "obsolete" files like index.html in includes/ that is to stop directory listing in case the .htaccess files work. I say blank them with a <HTML /> single tag in a page. I think because the define has changed then the old pages will fail, as one of the important constants has certainly altered.

The most common problem people have is callback failure. My opinion is that this is invariably caused by the host server configuration. Ask your host if they maintain sessions. If they say 'No' or don't know - move to a host that does know and says 'Yes'. I have allowed several people with callback problems to test their sites on my server. In every case the module worked first time.

A handy hint is that if worldpay fails with a 302 error, it means the password is wrong in either worldpay or the admin section, and your zencart installation is treating worldpay as a hacker.

[thomasharding]

Ok guys. Thanks to the genius working of Phil, I've got it working.

Basically - Follow the instructions on this post:

http://www.zen-cart.com/forum/showpo...&postcount=422

And ensure the WorldPay url is set to

https://<wpdisplay item="MC_callback">.

The result of this fix isn't final, I'll stress that. I did it on a test transaction and I'm about to try it on a live one.

If you read a news report of "Man in Manchester office block hangs himself with keyboard wire" then you know it's failed.

[philip_clarke]

I did offer you more help than that, but you went all quiet and shy, I thought you'd already done the keyboard thing.

[Jon>]

I wish mine had gone so smoothly - tried everything and I still get this callback error, both for cancelled and completed transactions in test mode.

Completely stumped now....

[Jon>]

Oh, and just to add - I went through it all with the host and he confirms that sessions are OK and it has nothing whatsoever to do with that...

[thomasharding]

I wish mine had gone so smoothly - tried everything and I still get this callback error, both for cancelled and completed transactions in test mode.

Completely stumped now....

Smooth? Haha.

You looked at 53 and 54 on worldpay.php? There might be a line quoted out which could be useful.

That was my first issue anyway, that I was sending myself to the wrong url.

[thomasharding]

Oh and just to update you all, my live transaction did not work :-(.

I'm getting the old "This was NOT a live transaction - no money has changed hands." error message, which probably means I'm caught up with everyone else who are so close.

[Jon>]

lol - yeah smoothly isn't a word I should have used but if someone got it working it looks smooth from where I'm sitting (with fistsfull of hair).

I'm using Phil's worldPay.php with the mods in and I've checked through everything in this thread, but still nothing works. Nothing commented out on those lines but thanks for the suggestion.