WorldPay Module version 2.0 - Support thread

Hi Philip,

We have an affiliate program in place on our site - it used to track all the affiliate transactions before - and the hidden tracking url was placed in tpl_checkout_success_default.php . At the moment after installing your module it only tracks the paypal orders --- Which tpl page is getting displayed by a worldpay module on the checkout --- is this --- tpl_modules_wp_checkout_success.php ???

In the previous module we had

$order_total_query = "SELECT value FROM orders_total
                 WHERE orders_id = " . $zv_orders_id . "
                 AND class = 'ot_subtotal'";

$webgains_total_query = $db->Execute($order_total_query);
$webgains_total = $webgains_total_query->fields['value'];

Set up in the header - of a success file -- to get a total of the order and than to be able to display it in the hidden tag on the wp_callback success?? am I right??

That's resonably correct, although displaying a hidden tag may be tricky if you read the above emails, since worldpay is filtering html on their side when they draw the page in,

Philip.

1. When i try the white listing on our site it doesn't return to the site at all - the order gets created but it does not go back to the shop.

Sorry, there was an error in the processing of this payment.
Please contact RBS WorldPay with details of your error if the problem persists.
Server information 28/Aug/2009 09:36:52 Server ID mg1imscs5pa (WPReq-4842)

2. It would be ideal if we could display the continue button on the worldpay success page which would take you to the standard zen cart success page with the order number like it was implemented in the old worldpay module -- would that be a problem for you to implement??

3 spoke to worldpay and they will definitely implement it... We are thinking of swicthing to protex

1. would be a worldpay problem

2. no not unless you would like people to mark goods up from your shop as paid and then you send them out only to find out that worldpay has been bypassed (because that button html code would need to contain your payment response password if I were to code it into the module)

3. implement what ? I think worldpay have killed themselves on this one. The trouble is that the amount of modifications and template chages that people make, which make ZC flexible, means it needs the base href tag of an entirely different engine to run it. I imagine some shop with limited template options or an engine that replaces links in templates, would work but then that's not ZC

Yep they are making the whitelisting compulsory on september 30th. BUT it still has some serious flaws.

I pointed this out to them (probably along with many others aswel) and they are apparently looking into to it and will notify me with an answer to why/ a fix.

Basically they do notpull in all the close tags, which in turn causes the stylesheets not to be implemented properly making the thankyou page look pretty bad.

Ofc you cant rely on them to get back to you, so i will keep pestering them, in a week or two for some progress.

I have used Sagepay(protx) on a couple of other zen cart sites recently, and iut has all gone ok without any problems....ofcourse swapping over is an option. But if your client/you have already done all the leg work to get worldpay setup then is it worth starting again and getting sagepay setup.

For me i dont like to give up and im determined to get the worldpay sorted ( also my client only has a worldpay account, and only wants to use them)

I also emailed Worldpay support just to see what the progress was on this base href tags and this is the response I received:

We are still looking at the possibility of allowing base href tag. I will keep you updated once I get any information from our technical team in UK.

I will give them a week but after being on the verge of launching for my site a while now as I wait to know all the changes needed to take place, I guess I better start looking for alternatives.

I did notice though they changed the whitelist date to October 14th.

I will let you guys know if I hear anything further. And Philip, thanks again for all the effort you have put into making the module work.

Khalil

since they pull the page from "a domain" then it would be trivial to complete a pattern match to limit the base href to "a domain". The other thing that is going to really put a spanner in the works is for people with customised templates, since they are killing javascript, so bang goes any drop down menus, and if I recall, the xml spec that was posted killed external stylesheets, now I know a lot of people don't do this, but there are accessibility issues then for the disabled or even for printing out the page as a "receipt".

What I find remarkable is that I think these modifications are entirely unnecessary. The main use of an XSS attack would be present false information to the user (I have some knowledge of this and you may want to read this article about me :smartalec: and the concept from last week)

http://www.theregister.co.uk/2009/08/27/nhs_spoof_email_xss_flaw/

To achieve an XSS attack on the WorldPay website in the manner they are trying to avoid, one would have to send out a mass email getting someone to go to a shop, buy something, pay for it, then either

• have the vicitims cookies stolen on a successful transaction and then a naughty hacker who had penetrated the website already (because they'd have needed to plant the tags to execute the cookie stealing code) would change the delivery address. This is exceptionally unlikely since the attacker/ cracker/ bad guy (my colleagues berate me for using the term hacker incorrectly) would already have been able to plant information, read data form the database by reading includes/configure.php so it would be a big waste of time and not very productive, it;s much easier to redirect the WorldPay/ other payment module form if one is on the server to complete a transparent man in the middle attack)
• present information under the WorldPay URL in the browser window that would be used to con people out of money which is very very unlikely since the victim would already have handed over the money. This attack relies on drawing in the information from a third party, but the cracker's already had access to the shop server so...

There's an easier way to do this which worldpay would have no defence against. One would create a "fake shop" or steal one, offering bargain goods, the attackers in this case would then be the shop owners or someone that had hijacked the shop complete with WorldPay details.

Instead of the "success" page one would swap it out for a totally new page that would say "your Mastercard secure code has not been accepted, please enter your details again". That new page could be correctly referenced without the need for a base href, would be displayed under the WorldPay URL and would pass all of their OWASP checks as it's not even cross site scripting, it would be a form (** see note at bottom) which would then post all of the data to Mr Bad Guy. Now that is a believable and real attack scenario.

This smacks of somebody not thinking things through, incorect interpretation of a middle management instruction or misunderstanding the concepts. Someone may want to point WorldPay in the direction of this post since I do not have a WP merchant account and therefore no phone contact.

Philip.

** from their antisamy xml specification

<tag name="form" action="validate">

which means they allow it through.:oops:

Philip,

I responded to their email and basically told them that this decision is a make or break for me, because the resulting web page looks totally unprofessional. Their response was:

I will feedback your concern to our technical team in UK. My apologies for causing you inconvenience.

In all fairness to the guy I am in contact with, he is just a middle man.

However, I have copied your reply verbatim and asked him to forward it to their technical team for comment. I will let you know what kind of response I get.

Thanks again,
Khalil

I do know that you Khalil have the coding skills to be implement a page without needing the base href tags, but most shop owners will not be able to.

Below are images from the RBS worldpay site. These are XSS vulnerabilities on their very own website which took me less than 10 minutes to find this morning. :oops:

You'll see an Iframe with this thread appearing in it

http://www.3xlock.com/rbs_xss.png

and then a JavaScript alert which means that the site could be entirely under the control of a "bad guy".

http://www.3xlock.com/rbs_xss1.png

They should consider solving their own real problems before pointing the finger at other people's products.

Philip.

Hi Philip,
I've installed the latest module and all is working fine apart from the return page from worldpay.
The return page is stripping out the:

Thanks,
Philip Hayes

I you read the previous page, you'll find that tis was a recent worldpay development where some idiot in the RBS decided to implement a stupid policy that acheives no useful purpose.

The only suggestion that anyone can make is that you manually link every item and link in your templates because unfortunately there's bugger all the module can do to things once they are over worldpay's side.

Philip (the very p*ssed off module maintainer).

Thanks for the quick reply, I missed that from the previous threads.
I'll try and hardcode all the problematic links.
Great module btw, thanks for all your hard work on this.

Philip

Thanks again Philip,

I got a little impatient and emailed them again asking for an expected date on the decison whether they will or will not fix this. Here is the response I got:

I can confirm that this issue has been raised with our IT department along with some other changes we have raised with the whitelist and we are still awaiting a definite response on each of these issues.

We would expect to hear back on these certainly before September 23rd when the whitelist goes live however I cannot give you an ETA on this.

I would also suggest looking into changing the URL's on the result page to absolute URL's if possible as this will resolve the issue without the need for the base href tag in the meantime.

My apologies for the inconvenience caused by this.

I guess if I want to continue with Worldpay and launch sometime this century I will have to make the necessary change. I just wonder what else they may have in store down the road...

Khalil

I had already implemented this change of doing absolute URL's .....but for it me it still didnt quite fix as Worldpay were not pulling in the closing tags of <li>'s or <options>'s so the CSS was still not working correctly!!

I raised this with them ages ago as you have done......and i also get the same responses, about they are looking into it and everything!....I will be chasing them again myself next week probably and seeing what response i get.

If you do decide to do the absolute URLs way, i would still recommend checking that it is pulling in all the other closing tags etc.

The worst thing for me is, i have just had a new client come on the books who already has a worldpay account, but is unaware about the problems they have been having! So looks like im going to have another Worldpay site to try and fix! ....uh oh

Hello,

are the following changes included in Version 2.10?

"Reminder: Technical Changes Affecting Payment Processing
Dear Customer,

We would like to remind you of several service updates that we have previously notified you about.

PCI DSS changes - technical changes occuring between the 16th September and 27th September:

16th September: Payment Notification (Callbacks) IP Address Changes
17th September: Secure Test Environment and the Payment Page Editor will be unavailable for up to (approx) 4 hrs (rescheduled from 10th September)
26th September: Risk Management Service will be unavailable for up to (approx) 2 hrs
27th September: Recurring Payment Service (FuturePay) will be unavailable for up to (approx) 2 hrs
Subsequent changes / maintenance slots that have previously been communicated have also been rescheduled – more information on our Business Gateway Service News & Updates Page
Payment Pages - technical changes on 23rd September:

technical change that could affect display of RBS WorldPay payment pages

Please Get Ready: It's important you review these changes and, where indicated, cascade the information to those responsible for your website and its technical set-up beforehand, in order to ensure you can continue to accept payments without disruption when we make the changes."

Well I got a response from Tech Support:

We are starting to receive feedback from IT on the list of issues we've raised and unfortunately the base href tag will remain filtered for security reasons.

We have raised the issue with the li and option tags which was also raised by another ZenCart merchant and hope it will be possible to resolve this particular issue, please accept my apologies for any inconvenience caused by this in the meantime.

I believe I will start looking for another gateway...

Khalil

I declare this module closed since worldpay has made it unfeasible for the "normal" person to display a shop receipt.

THIS MODULE IS CLOSED

Hello Folks, well this is so sad as I think the Worldpay module works very well. I had a feeling this would be the outcome. We will be closing our account with Worldpay and sending them a strongly worded letter and demanding our annual rip off fee back from them which we recently renewed. In the mean time we will continue using Paypal till we are sure no other merchants are going to introduce the same measure that Worldpay have done. Well done for designing this module Philip, keep up the good work. Peter. P.S. I will certainly not be recommending Worldpay to anyone and would hope others here will follow...

philip_clarke:

I declare this module closed since worldpay has made it unfeasible for the "normal" person to display a shop receipt.

THIS MODULE IS CLOSED

Hi Philip

What does this mean? I currently have your worldpay module installed. I've not tested it since reading this post. will it currenly work?

When you say "normal". Has something changed.

I'm panicking a little here.

I noticed that RBS sent me some emails regarding changes that will be made next week.

Jason

Spoke to worldpay - and apparently they are looking into allowing base href tag -- and there are few extra restrictions still in a test mode that will be removed before it goes live. Please don't leave us Philip