WorldPay Module version 2.0 - Support thread

[Dave G]

One of my customers received this email today from WP. I am hoping some one with more knowledge than I will be able to make any necessary changes to this mod to comply with the change.

Thank You
Dave G

We have made a change to MD5, a feature which you currently use to protect the transaction parameters you send to our payment service for processing. This is an essential update, which we have made to improve security.

As a result of making this change, we now need to ask you to make some small adjustments to your payment service. Importantly, you will need to make these by the 31st of May 2011 in order to continue with your current method of using MD5.

**** What is MD5? ***

MD5 is a security feature that is used to verify that the transaction submission parameters supplied by your website to our payment gateway have not been tampered with. When enabled, it allows you to secure your choice of parameters and ensure these cannot be modified by a fraudster who could potentially change details of what has been purchased, or the amount of the transaction.

**** What changes do you need to make and important dates? ***

The changes you need to make require some small adjustments to the way in which you currently pass the ‘signatureFields’ parameter. This parameter is used by your system to list the transaction parameters that must be encrypted. It is currently sent in your order details submission.

>From today, you will be able to choose between two different methods of signing your transactions. The specific changes that you will need to make will depend on which of these your system uses to generate the MD5 signature:

Static Signatures (recommended method of generating MD5 signatures)

Merchants, who encrypt the same transaction parameters for every transaction, must now specify their signatureFields value in their Installation Settings located in the Merchant Administration Interface. Please note that this replaces the need to send the signatureFields parameter in your order details submission.

Dynamic Signatures

If however your system encrypts different transaction parameters for each transaction passed, you must now add the signatureFields parameter in the string used to calculate the MD5 signature and replace the current colon separation of parameters with semi colons.

It is important that you make the required changes by the 31st of May 2011.

*** Next steps ***

For further information and about this update and instructions on how to make the required changes please read the news page entitled ‘MD5 Update,’ by following the link below:

http://www.rbsworldpay.com/support/b...s&sub=md5&c=UK

[WebMC]

Do we need ssl for this mod to work then?

I am getting a password failure from my server in debug emails even thought they are the same both ends.

[dab]

One of my customers received this email today from WP. I am hoping some one with more knowledge than I will be able to make any necessary changes to this mod to comply with the change.

Thank You
Dave G

Yes, we received the same email from RBS Worldpay today, so it looks like something is going to need changing to keep it working.

[mach9]

Yes we recieved it too from Worldpay. Not exactly sure how to implement this.

[Keitex]

Hi, I am trying to upgrade to the new version of WP but in modules section it still tells me I am using 2.9 version after I deleted all the old files. Does this matter?

[dab]

As a result of making this change, we now need to ask you to make some small adjustments to your payment service. Importantly, you will need to make these by the 31st of May 2011 in order to continue with your current method of using MD5

I have been having a look at the requirements for this change, and also spoken wth RBS WorldPay tech support. I have now done a change to my 1.37 site which seems to work in the new format - use at your own risk.

In /includes/modules/payment/worldpay.php around line 299 there is a line like this:

$md5_signature = MODULE_PAYMENT_WORLDPAY_MD5KEY . ':'.$OrderAmt.':' . $currency . ':' . $order->customer['email_address']; 

which I have changed to

$md5_signature = MODULE_PAYMENT_WORLDPAY_MD5KEY . ';' . $md5_signature_fields . ';' . $OrderAmt . ';' . $currency . ';' . $order->customer['email_address']; 

Note that the separators have changed as well as the additional field.
If you get to the Worldpay page with the card logos, then I believe it is working ok, otherwise you will get an error at this point.

[Bigenuf]

I have been having a look at the requirements for this change, and also spoken wth RBS WorldPay tech support. I have now done a change to my 1.37 site which seems to work in the new format - use at your own risk.

In /includes/modules/payment/worldpay.php around line 299 there is a line like this:

$md5_signature = MODULE_PAYMENT_WORLDPAY_MD5KEY . ':'.$OrderAmt.':' . $currency . ':' . $order->customer['email_address']; 

which I have changed to

$md5_signature = MODULE_PAYMENT_WORLDPAY_MD5KEY . ';' . $md5_signature_fields . ';' . $OrderAmt . ';' . $currency . ';' . $order->customer['email_address']; 

Note that the separators have changed as well as the additional field.
If you get to the Worldpay page with the card logos, then I believe it is working ok, otherwise you will get an error at this point.

OK then what do we put into the new SignatureFields slot which is now present in the worldpay setup in both the test and production environments?
Although i haven't had time to test it i believe all that should need to be done is add
" amount:currency:email " without the " into the SignatureFields slot.
This information can be found in /includes/modules/payment/worldpay.php line 298.
How i read the worldpay information is that they have added this new field and all you are doing is telling them what info in what order you will be sending to them and it verifies that along with everything else it does.
Like i said this is untested but i'm sure if you have just made changes to your worldpay script and not changed anything in the worldpay environment on their site i can't see how it could work because they have no information on their site to match what you will be sending.
Test only in the test environment. Use at your own risk.

[dab]

OK then what do we put into the new SignatureFields slot which is now present in the worldpay setup in both the test and production environments?

I think the difference is that, as mentioned in the Worldpay email above, there are two methods of calculationg the signature, Static and Dynamic. The method originally used by this contribution seems to be dynamic, so that's how I carried on. I presume the new field on Worldpay is for Static signatures.

[Bigenuf]

I think the difference is that, as mentioned in the Worldpay email above, there are two methods of calculationg the signature, Static and Dynamic. The method originally used by this contribution seems to be dynamic, so that's how I carried on. I presume the new field on Worldpay is for Static signatures.

I seem to think it is static, what i did was put amount:currency:email
into SignatureFields in the worldpay admin area in test and did a test purchase and everything worked great.

I went back into the test environment on worldpay and removed the email and left ie: amount:currency and did a test purchase and received this message on the worldpay site:


Secure Payment Page
Sorry, there was an error in processing this transaction:
The information sent from the merchant's site is invalid or incomplete. Please send the following information to the merchant:

The transaction cannot be processed due to the following:

* the MD5 signature could not be verified

Server information 02/Jan/2011 11:07:25 Server ID mm2imscs4p (WPReq-442646)

I went back in and added the email again and the test purchase went through with no errors.

I have added this into my production environment and will see if there are any problems with orders coming in. I'll post results as i have orders coming through today and should know before long.

Only Phil i would think would know if it is static or dynamic but this seems to work without changing any of the scripting i guess you could change the order of you SignatureField in the script and change it in the worldpay setup, just to make yours different then others for added security.

Cheers.

[Bigenuf]

I can confirm that the changes i suggested in my last post DO work in a LIVE environment on worldpay. I've had 3 orders come in in the last hour with no problems.

Just for the record i'm using Worldpay module 2.10 on 2 versions of zencart, 1.3.7.1 and 1.3.8a

And responding to a previous posting version 2.10 will show version 2.09 in your admin.

As always backup everything and use in test environment first then go live. Use at your own risk.

Also as to if it is dynamic or static according to worldpay this module should be static

Static Signatures (recommended method of generating MD5 signatures)

Merchants, who encrypt the same transaction parameters for every transaction, must now specify their signatureFields value in their Installation Settings located in the Merchant Administration Interface. Please note that this replaces the need to send the signatureFields parameter in your order details submission.

This module sends the same params each time.

Cheers