WorldPay Module version 2.0 - Support thread

[Bigenuf]

I've thrown this together and would appreciate if someone who knows what they are doing can have a look at it and see if it will actually work. I've made it so that all one needs to do is drop a folder into their templates folder and it will take care of this worldpay problem.
This is not intended to be a permanent fix just a stop gap measure until Worldpay decides to pull their heads out.
See the following Screen captures of both the Success and Cancelled pages.





Since the mechanics of this module work great all we are bothered with is what the customer sees after they have either completed their transaction or cancelled it and this , i believe, is an acceptable outcome for those of us who are challenged

Because forum rules prohibit me from posting a link to this fix if you Philip or anyone else who wants to have a look at it will either PM me or email me and i'll send you a link to it.

[oxxyfx]

Now I need to understand this. Are these problems going to be because of some future changes, or the changes are already actually in effect?

The reason why I am asking is because I just processed a test payment through my website and WP and all it seemed normal. All screens were the same as they were 6 months ago...

[philip_clarke]

Now I need to understand this. Are these problems going to be because of some future changes, or the changes are already actually in effect?

The reason why I am asking is because I just processed a test payment through my website and WP and all it seemed normal. All screens were the same as they were 6 months ago...

The changes will be coming to global effect inside 14 days. Some people have already got them and have ben discussing it for weeks. This is one of the odd situations that I find myself in, because I maintain the module but don't have a wordlpay account. Bigenuf's suggestions are pretty much the only way that the worldpay module would work in the future, But a lot of people will leave worldpay just because they have been so obtruse during this discussion, given conflicting information and I have lost count of the times that they has "blamed the module" for errors with new users over the last year.

[Bigenuf]

Link sent, if you need anything else just let me know. I'll be up around 4 am starting work

[philip_clarke]

I'll probably be going to bed around then ;o

[Bigenuf]

Now I need to understand this. Are these problems going to be because of some future changes, or the changes are already actually in effect?

The reason why I am asking is because I just processed a test payment through my website and WP and all it seemed normal. All screens were the same as they were 6 months ago...

To see what were dealing with go into your worldpay account and go into the test environment 3/4 of the way down the page you will see a check box to enable or disable the "whitelisting". If it is enabled , it should be enabled by default at the present time, then you can test it otherwise change and save it.

Go into your zencart admin Modules>Payment>Worldpay Credit card payments, 2.10 is the current version, edit this module and set it into TEST Mode . Save it and then do a test transaction. The easiest way is to purchase something on your site, choose Worlpay as the payment option, go to Worldpay and then cancel the payment and you should return to your site.

At the present time this will only look like this when you have whitelisting enabled but shortly you will not have an option to turn it on or off and your result pages will be a mess.

Now go back and turn the test mode off in the Worldpay module so your customers can make purchases.

Please be aware of the timelines for making these changes.

August 2009: the Test Environment will begin to enforce our list of permitted HTML tags so you can test payment pages before setting them live.

September 23rd 2009: we will activate our list of permitted HTML tags for all live payment pages for all customers. At this point any visual impairment to the design of your payment pages caused by the measures we are taking to prevent cross site scripting will be visible to your shoppers. If this causes an issue for your payment pages you can remove the list from your installation via our Merchant Interface(see Disabling and Re enabling Whitelist in Technical Notes below) up until the 14th October 2009 from when all installations will work with the list of permitted HTML tags without exception.

We will update you with further details nearer the time letting you know when to start reviewing your payment pages in the Test and Production environment.

The article is here.

http://www.rbsworldpay.com/support/b...s&sub=xss&c=UK

Cheers

[philip_clarke]

You know those modifications ? I can here something, it's very faint at the moment but it's going tick tock, tick tock. (all will be revealed soon)

[philip_clarke]

Tick Tock Tick Tock

[philip_clarke]

Tick Tock Tick Tock

It's a bomb.

I've thrown this together.....

And helped invent the perfect way that enables RBSworldpay to help you con people out of money (what a great banking organisation, no wonder there's cockney rhyming slang for Merchant banker)!

If one takes your code and swaps the pages, so that the cancel page is the success page...

then generates a random shopping cart number and post the shopping cart information back (with a click to continue button), RBSworldpay will charge again.

The RBSworldpay system makes the assumption that the shopping cart will be submitted once and that it's unique, so randomise the cart Id and con away. This way you could set up a loop.

Customer buys something, RBSworldpay says it's cancelled, customer pays again, it won't stop till the customer is bored. Of course the cunning fraudster could do all kinds of things too, like "add a bit" to the invoice, or change the address to a random one. (to stop worldpay immediately querying six duplicate transactions for each customer). Loop only once, and then show the completed transaction. Time it right and "the con" could go on for about 30 days before doing a runner with the money.

Naturally you send out the client's first order so that they think everything worked, and your client is going to complain to "you" first of all. With a little randomisation it would be possible to only refund the people that "complained", some people wouldn't notice, and keep "the con" running much longer, "of course you don't know why worldpay keeps on charging your customers twice".

For the ones you "said" you refunded would have to wait for their next CC statement anyway, so in the majority that's almost 60 days of conning.

Hold on. Weren't these XSS measures supposed to make it more difficult to carry out fraud ? Not Easier

Anyway, great stuff Bigenuf, if RBSworldpay continues to be stupid, I'll include it as compulsory in the module, probably with a shop logo, since the current default's going to fall to pieces anyway.

Philip.

[Bigenuf]

I've always been told if i Actually knew what i was doing i would be dangerous Glad i could help.