WorldPay Module version 2.0 - Support thread

Philip, Just spotted acouple of things in the /includes/modules/payment/worldpay.php file that i would like to double check are correct if thats ok

On line 33 it points says 'includes/templates/template_default/templates/tpl_wpcallback_default.php' but that file isnt located in template_default for me, it is in my custom overrides folder.....is that an issue?

Secondly on line 75 the address it points to is https://secure-test.wp3.rbsworldpay.com/wcc/purchase, but the web address i end up on is https://secure-test.wp3.rbsworldpay.com/wcc/card

Could they be causing a problem?

Hello Philip. My brain hurts. I tried various things like hard coding the base href tag in and putting little messages in html_header.php (which did pass through) but Worldpay ARE definitely filtering out the base href tag due to the new security standards. They say that until the 30th September 2009 you can disable the "Enable whitelisting?" setting in your Worldpay Installation Administration page. I did this and BINGO:clap: the "Thank you" and "Order Cancelled" pages display properly... the base href tag is there in the source code. I tried looking at the various sites they point you to for information (https://www.owasp.org and https://www.pcisecuritystandards.org) but I got a bit bewildered. I have sent an email to [email protected] (because their stupid contact form doesn't work!) I have explained what the problem is and that it will become a big problem unless they can provide a solution. Something needs to be done or we simply can't use Worldpay with Zencart I imagine. :unsure:

petelutonuk, you obviously had a better phonecall with worldpay than i did....my tech support person was not very technical at all.

I had a look at rbs site again and found the page about the cahnges and about switching off whitelisting for the time being.....so that will solve the problem for like a month.

But by the end of september it will be back to not displaying the pages properly, due to XSS (i belive this is what philip was thinking they were doing earlier)

Heres the to the page on worldpay http://www.rbsworldpay.com/support/bg/index.php?page=news&sub=xss&c=UK

When the whitelisting (safe attribute thing) gets enforced on 30th sep, its going to cause alot of problems, with us zen cart users, and i would imagine alot of other people aswel!

Hi, I didn't actually speak to anyone at Worldpay but tried what they said in the emails and all my sites worked including the one I have had for 8 years which is simple XHTML with a php search engine... even that will be going to hell in a hand cart at the end of September. I haven't actually found a list of the permitted code we are allowed to use....I am starting to despair! I just hope they reply with some useful information A.S.A.P. :frusty:

:ohmy::censored::no:Well I got my first email response from RBSWorldpay at 1AM. They asked me if it was just the images and stylesheet that were missing which I confirmed. I received this reply....

By uploading your images and CSS (I have yet to test this) to our WorldPay server via our "Payment Page Editor" through our Merchant Administration Interface should solves the display problem. To reference them, the code is as follows:<img src="/i/XXXX/filename.extension"> (XXXX refers to your installation id)

Please note that your CSS file extension should be in lower caps (eg styles.css instead of styles.CSS). All filenames uploaded to WorldPay server are case sensitive, so if the filename is Mylogo.jpg, on your XHTML file it should points to Mylogo.jpg instead of mylogo.jpg.

Please do not hesitate to contact us should you require our further assistance or clarification.

This looks like a lot of hassle to me and as you can see he has not even tried it, I am not convinced this will work because of the way Zen cart works and would mean the site is not all under the control of the Zencart admin section. I will try uploading a few things to my worldpay installation this evening after work. :bangin:

Yeh i was told the same thing, about uploading images and css to their server, was also told i could make the links abosulte

Will be easy enough to make the CSS link an absolute URL, but not sure about images tho

Although i think all my images for the thankyou page are in the styles anyway....so i might be able to get away with it.

Will have to give it a test either today or friday....whenever i get a spare minute really

Well i have made some progress i guess, i converted all the css links into absolute URLS, and now worldpay does pick them up and it is styling it to a degree......but if you do a view source, it doesnt pick up all the tags properly.....it has left out all the </ option> tags etc,

Which isnt good.... and the styles arnt quite right

Just think i need to keep at it and see where i get to

Hi Phillip

I wonder if you could help
i am running the latest version of zencart and the latest worldpay module

I have set it all up accoring to the instructions you provided, but when i do a test transaction and get directed back to the site the page is missing the stylesheet and images, all the correct content is there and the order is added to the zencart admin but the page doesnt display correct. I also notice that the url in the address bar is still the worldpay rbs one?

Any ideas, the same thing happens when i click cancel transaction.

Do you think its a test mode issue? or worldpay set up problem?

Thanks for any help you can provide

Hi idlerob, yes, no need to ask Philip just yet, I discovered this last week and it is that RBSWorldpay are now filtering out the <base href tag which refers to the style sheet info and paths to images etc. If you read the last few pages on this thread you will see that nobody yet knows a solution. From what you say, you have not done anything wrong. If I were you, I would wait to see what Philip comes up with and if Worldpay's support can help. In the mean time you can go into your Worldpay admin set up and untick enable whitelist. Your pages should then display ok so you can view them BUT on 30th September Worldpay will enforce the white list...so we need a solution. :smile:

thanks petelutonuk thats a great help, i have disabled that for the time being and will keep an eye out for the update.

cheers
Rob

i hate to say it, but i really doubt there will be an update to it.... there isnt anything wrong with the module that philip has created. The problem has been created at worldpays end with there new security updates

If worldpay are going to be restrictive on what tags get pulled in, or what they call 'safe tags' then i highly doubt there is anything philip will be able to do.

I have pretty much got around this at the minute by using absoulte URLs for the stylesheets rather than them relying on a base href tag.

I am thinking this may be the only way forward

:(

Yes ooba, I agree. I don't want to keep posting every time I move on a stage but below is the latest reply I had from Worldpay. I would suggest that someone who knows a lot more than I do has a good look at it if they haven't already. I am going to keep experimenting and you never know Worldpay could still come up with an answer.

Based on our communication to our merchants as regards to this technical change, there is a link that provides a list of parameters that are accepted by our server. Below is the xml file link of this list of parameters:
http://owaspantisamy.googlecode.com/files/antisamy-1.3.xml
I could not find the base href parameter in this list so I'm afraid this parameter will be blocked by us. What I can do is, I will feedback this to our technical team in UK who can look into this issue to see if there is any reason why this parameter is being blocked. I will give you an update once I got any reply from them. Meanwhile you may wish to try the method I gave earlier in this email to see if it could work for you for this interim period.
Please do not hesitate to contact us should you require our further assistance or clarification.

I don't know if this line in that xml document tells us anything...
base tag removed per demo

Still no response from RBSWorldpay regarding their reason for filtering of all important base href tag. I tried what Philip suggested in post 333 using java script to split up the tag to fool the filtering but I get a blank page after the transaction has been made. Perhaps it is time for Zencart and RBSWorldpay to part company? I have used Worldpay for the last 9 years, perhaps it is time to try someone else, any suggestions?

Bugger guys, so sorry for not replying, for some reason the fourm wasn't telling me that there were new posts.

What can I say or do ? hands tied and all that, I suggest vigourous complaints but that's all I can think off. The code

<script language="javascript">

document.write('<ba'+'se href'+'="http://example.com/" />');

</script>

(you may need https) is sound when I test it it really does depend on how they are doing their stripping as to wether you can pull it off with more simple html like

<base \ href="http://example.com/" />

<base \0 href="http://example.com/" />

<base \
 href=http://example.com/ />

<base \
 href=http://example.com/ />

<base
 href=http://example.com/ />

<base
 href=http://example.com/ </div>

<base 
 href=
 http://example.com/ </div>

<base/worldpay
 href=
 http://example.com/ </div>

<base/worldpay
 worldpay/href=http://example.com/ </div>

The above will work on firefox 3.0 for setting a base href tag, the enter are deliberate as are the obfuscation. Remember you may need to use https if anyone would like to have an off topic conversation about filter evasion techniques, I am happy to point them in the right direction.

If that little lot doesn't work then (and honestly it doesn't with strip_tags() in PHP) then I'll try some increasingly more despearte measures.

Philip.

To be honest, if they are doing all these security measures to stop XSS, and only use safe tags.....then i would assume they are going to cover all possible workarounds that people might use to get them to accept their tags..... so sadly i dnt think any of these genius ideas are going to work :( ( i did try afew last week, with no lucK)

In the end i hardcoded the absolute links in, and it is semi working....im jst trying to do a bit more work on why it isnt picking up all the styles correctly, then hopefully the problem is pretty much fixed for me. Luckily my client hasnt started jumping up and down yet :S

But thanks philip for your ideas and efforts :)

Having had a look at their antisamy spec, if their filter is any good and the obfuscation does not work, then there's not much chance since they have rigged the stylesheet tags to use on text/css (you can set them text/html) and @import and LINK tags are similar or disabled entirely.

I'm still looking for something, the script tags are not mentioned and I assume anything not listed is stripped, but what is strange that the file mentions id listed as

 Example policy file (far too permissive for production use) 

which is lunatic. ANTISAMY is not designed for this. It's designed to allow users to enter things into a text box and to see the results without have malicious tages enters, it is not designed to pull in a third party application and then filter it and display it. Yes Worldpay could be attacked using XSS but only after a transaction was made and completed and the card verified. I possibly (this is on the outskirts of possibility) could write a conversion program for the module where you have to run your templates through it and it could create full url links if you like ? I can't alter "the module" by a default as you "the users" could be using any kind of template and styles so there is no default (you could be pulling new items, there could be database driven items showing best selling things), you have sideboxes that might be hardcoded)....

I'll have a think, but I suggest £20 a month gets you a paypall pro account with a virtual terminal where you can take numbers over the telephone and the modules are more advanced, which seems cheaper and better than a company that seems intent on destroying it's client base.

Philip.

Yeah totally agree with you

I have a feeling they are going to lose alot of business through this new antisamy thingy..... if a client asks what payment gateway to use, def will not be suggesting worldpay!

But sadly client already has had a worldpay account and has been using it in the past.....so i dont think i will be able to persuade him to change anytime soon.

Setup protx acouple of times, and that was perfect, no problems at all..

There thing doesnt seem to pull in all the tags anyway, i had a quick look at the source code alst week and i noticed it was pulling in the <option> tag, but it was never pulling in the close tag for it....They surely cant be filtering out only the close tag....but i wouldnt put it past them at the minute tho, haha

Yeah im still trying to think of a solution, but running out of options and solutions

If none of the above code works then I doubt it's possible. I've been looking at that "permissive" owasp filter and they've crippled any webpage that is not plain text with fully formed links.

Unless there's an article in the knowledge base about how to bypass the sucking in process (and then they have adding a whole new feature), I fear tha everyone is going to be hard coding this weeked. Or whenever they find out....(queue months of answering the same questiosn over and over...)

Philip

Haha yeh, well come the 30 of sept, when they make it compulsory....then people who already have this mod will all be coming accross the same problems :S

I am happy to try and answer peoples questions when the floods come in! haha

I emailed support at worldpay on friday asking about why the base href tags get filtered and why they dont pick up all of the close tags properly......and apparently they are aware of this issue and are currently investigating. They suggest turning off the whitelisting for the time being

So it sounds to me that probably enough people have complained and asked questions about this issue for them to look into it and fingers crossed find a solution!

Might be a good idea to keep checking worldpay news and updates section to see if they have fixed this issue :)