WorldPay Module version 2.0 - Support thread

well rbs seems to pull in your thank you page, and the url is something simialr to this

https://secure-test.wp3.rbsworldpay.com/wcc/card?op-PMGetNextPage&PaymentID=xxxxxxxxxxxxxxxx

The thankyou page, has all the components of your zencart shop, like sideboxes etc apart from the styles and images!

I thought you mentioned in an earlier post that worldpay sucked in the thank you page, bar insecure parts like stylessheets ?!? maybe im wrong and thats from a diff thread.....

What I mean is that when worldpay sucks it in, I'm sure there used to be a base href tag in there and I'm sure they added it. Is there one now ?

o right, no not that i oculd see.....thats why i thought had to add one in....

I assumed they removed it at some point recently.

since people have started falling to pieces recently I would assume so too.

hmmm yeah

Unless i have something else going on and not what i previously thought...

I had a quick flick through the thread and it seems only recently this has happened to a few people......

You said worldpay are implementing some changes tommorow? ...could that have anything to do with it?

I think this stems from before then. They mentioned an IE8 alert box that comes up warning customers of security problems, so that is what they were going to fix, and it got me thinking about how they maintained the links on people's sites what with the pulling the pages in, then I thought ahh, they must be adding a base href tag, but since the problem has come up, I guess not.

They'll be a fix this evening which will published int he add-ins section at some time in the future.

Philip

o right maybe it does stem from earlier on then.
Im not sure that pulling in pages is the best way forward espec if they are not pulling in styles and images......its even a pretty simple fix for them.

Ok well i will look forward to seeing the fix.
Hope it isnt going to be too hard to do!

It'll be an install and go, if I get it right first time and if I don't find anything when I look through the historical archives of the releases that suggest there may be something else at work.

Philip

good luck

Hi Philip and Ooba_Scott,

Well done so far, looks like other people will be noticing the problem sooner or later.
I have nothing more useful to add apart from I know I still get the problem in IE7, IE8, Firefox, Opera and the only pages that do not contain the <base href="...."> tag in the source code are the ones from Worldpay. As you say the only place it appears in Zen cart is at /includes/templates/template_default/common/html_header.php I tried "shuvving" the tag in various files but only made matters worse.

I would assume that if the <base href> tag is being passed to Worldpay but does not appear in the source code, perhaps they have some way of filtering it out?
I await a solution and am of course willing to try it out as soon as possible. What worries me is that even if there is a cure now, Worldpay will mess it up further down the line...:clap:

I am going to need version numbers of zen cart and I am going to need copies of shop pages saved when the URL displayed in the toolbar is at worldpay because I have examined the code and it's based on solid ZC foundations, where the base href is defined by default. If you do not have a base href it may be one of two things

1. that you have a non standard template that needs one adding to it.
2. that worldpay is stripping it out for some reason.
   Your zen cart default template is called

includes/templates/template_default/common/html_header.php

and should have the line in it

<base href="<?php echo (($request_type == 'SSL') ? HTTPS_SERVER . DIR_WS_HTTPS_CATALOG : HTTP_SERVER . DIR_WS_CATALOG ); ?>" />

If you are using the default ZC template then wordpay is stripping the base href out for some unknown reason. If however you are using someone's template, it may be that the designer has not put the code in a cusomised header, in which case you will need to find your header file. I can't tell you where this will be as it would depend on your directory structure and the template name, but it will be called html_header.php

There will not be a version 2.11 released because of these reports, because there is nothing I can do. In situation 1) it would be up to you to check that you have the base href code in situ in case 2) it will be up to you complain to worldpay.

I would like to see a posting on this forum detailing which scenario it tunred out to be though

best of luck
Philip

Hello Philip. I only know a little php, I am better at xhtml but I am now pretty sure Worldpay is stripping out the base href tag. When I can I will contact them, though I would hope someone else will as well, they may take notice then.

I can let you know privately one of my domains so you can look at the code coming back if you wish or I can paste the "Thank you" page to you privately.
I did copy the html_header.php into the common folder in the template I have been using but it made no difference. Whatever template I use, I get the problem.

The base href tag is still on the last page before you are taken to the Worldpay page and I imagine the code is passed to them? It is very frustrating and makes the module basically unusable so they need to do something about it if it is their end. Peter:smile:

Have you added a comment in the html something like

<!-- oi world pay pay attention -->

just to make sure that you are editing the correct header file and also as more "evidence", because sorry guys but you are on your own on this one. The module is working fine and is referencing the correct default ZC file structure and this is not something the module can override (otherwise it'd bugger everyone's template modifications).

Philip.

Just been on the phone to technical support ( who really wernt techincal) struggled with the term stylesheets and styles

They are not quite sure why it isnt picking up the styles, but it could have somehting to do with the changes they are trying to implement.....but she coldnt give me a time frame when they will be finished. She said they were still in test mode.....so who knows.

They are going to test my site and keep me updated, but im not going to hold my breath on them fixing it.....

Scott

You may be interested in this link to the worldpay changes that have/ are taking place in august.

There is also abit about the 'callback' system....not sure if you have already seen and read this philip (im sure you have)

http://www.rbsworldpay.com/support/bg/index.php?page=news&sub=rebrand&c=UK

Scott

Read that, some systems don't allow anything to connect to the worldpay module (the callback system) unless the domain ends in worlpay, that's not us. The reason why is that although it increases security I can't guarantee that with the thousand odd web servers that use this module, that they are configured correctly to look up the host hane of incoming connections, plus worldpay has a 30 second time out when it sucks the page in, so there's a real possibility taht it could lead to more errors.

This would be simple to add if it were based on ip addresses because then non nameserver look up would be required, but sparky monkeys over there, never saw fit to channel things through a constant range of addresses instead they add them a random it would have been trivial to bounce all requests through one ip address, but nope they rely on the weak point of the internet, the DNS system.

Philip.

Yeah did think you would have read it, but thought it was just worth posting to be on the safe side....

Im kinda playing the waiting game now and seeing if what they come back with....or trying to figure out something myself.

Will have to see what they tell petelutonuk, if he manages to give them a call.....he may get told a different story depending on which techy person you speak to. So his person may come up trumps and offer a solution

Well what I suggest is using the techniques used to find xss exploits. What would seem to be happening over at worldpay is that they suck the page through and knock off the <base href tag from header_php.php so what you could do is some of these combinations in your file and see if you can fool the part of their program that recognises the tag.

First of all you need to be 100% positive you are editing the correct file for your layout. the default is at

includes/templates/template_default/common/html_header.php

so if you put

<!--hello world-->

in that page then you should see it appear on worldpay's suck through page, otherwise you look for other header files in your template overrride structure

then you would replace the line

<base href="<?php echo (($request_type == 'SSL') ? HTTPS_SERVER . DIR_WS_HTTPS_CATALOG : HTTP_SERVER . DIR_WS_CATALOG ); ?>" />

<base \ href=<?php echo (($request_type == 'SSL') ? HTTPS_SERVER . DIR_WS_HTTPS_CATALOG : HTTP_SERVER . DIR_WS_CATALOG ); ?>" />

or

<base \0 href=<?php echo (($request_type == 'SSL') ? HTTPS_SERVER . DIR_WS_HTTPS_CATALOG : HTTP_SERVER . DIR_WS_CATALOG ); ?>" />

or this should work

<script language="javascript" type="text/javascript">
document.write('<ba'+'se '+'href="');
</script>
<noscript><base href="</noscript><?php echo (($request_type == 'SSL') ? HTTPS_SERVER . DIR_WS_HTTPS_CATALOG : HTTP_SERVER . DIR_WS_CATALOG ); ?>" />

Philip

Thanks for taht Philip......i did have a go yesterday, but my brain was frazzled and i didnt get very far......im feeling more awake today so may give it a go if i geta free minute.

I have already located the file in the template_default and i havnt changed it in my override system so thats easy to find and change.

Bit of a busy day at the office today so may have to leave it till tommorow

Not really expecting a response from worldpay unless i constantly phone them..

But will keep you all posted on my findings and all

It is ironic that if the changes made are to stop potential xss warnings, that I have to suggest using my xss knowledge to circumvent the issue. I doubt the javascript one would trigger an issue since it is similar in stucture to google analytics.