WorldPay Module version 2.0 - Support thread

Link sent, if you need anything else just let me know. I'll be up around 4 am starting work:shocking:

I'll probably be going to bed around then ;o

oxxyfx:

Now I need to understand this. Are these problems going to be because of some future changes, or the changes are already actually in effect?

The reason why I am asking is because I just processed a test payment through my website and WP and all it seemed normal. All screens were the same as they were 6 months ago...

To see what were dealing with go into your worldpay account and go into the test environment 3/4 of the way down the page you will see a check box to enable or disable the "whitelisting". If it is enabled , it should be enabled by default at the present time, then you can test it otherwise change and save it.

Go into your zencart admin Modules>Payment>Worldpay Credit card payments, 2.10 is the current version, edit this module and set it into TEST Mode . Save it and then do a test transaction. The easiest way is to purchase something on your site, choose Worlpay as the payment option, go to Worldpay and then cancel the payment and you should return to your site.

At the present time this will only look like this when you have whitelisting enabled but shortly you will not have an option to turn it on or off and your result pages will be a mess.

Now go back and turn the test mode off in the Worldpay module so your customers can make purchases.

Please be aware of the timelines for making these changes.

August 2009: the Test Environment will begin to enforce our list of permitted HTML tags so you can test payment pages before setting them live.

September 23rd 2009: we will activate our list of permitted HTML tags for all live payment pages for all customers. At this point any visual impairment to the design of your payment pages caused by the measures we are taking to prevent cross site scripting will be visible to your shoppers. If this causes an issue for your payment pages you can remove the list from your installation via our Merchant Interface(see Disabling and Re enabling Whitelist in Technical Notes below) up until the 14th October 2009 from when all installations will work with the list of permitted HTML tags without exception.

We will update you with further details nearer the time letting you know when to start reviewing your payment pages in the Test and Production environment.

The article is here.

http://www.rbsworldpay.com/support/bg/index.php?page=news&sub=xss&c=UK

Cheers

You know those modifications ? I can here something, it's very faint at the moment but it's going tick tock, tick tock. (all will be revealed soon)

Tick Tock Tick Tock

Tick Tock*** Tick Tock ***

It's a bomb.

Bigenuf:

I've thrown this together.....

And helped invent the perfect way that enables RBSworldpay to help you con people out of money (what a great banking organisation, no wonder there's cockney rhyming slang for Merchant banker)!

If one takes your code and swaps the pages, so that the cancel page is the success page...

then generates a random shopping cart number and post the shopping cart information back (with a click to continue button), RBSworldpay will charge again.

The RBSworldpay system makes the assumption that the shopping cart will be submitted once and that it's unique, so randomise the cart Id and con away. This way you could set up a loop.

Customer buys something, RBSworldpay says it's cancelled, customer pays again, it won't stop till the customer is bored. Of course the cunning fraudster could do all kinds of things too, like "add a bit" to the invoice, or change the address to a random one. (to stop worldpay immediately querying six duplicate transactions for each customer). Loop only once, and then show the completed transaction. Time it right and "the con" could go on for about 30 days before doing a runner with the money.

Naturally you send out the client's first order so that they think everything worked, and your client is going to complain to "you" first of all. With a little randomisation it would be possible to only refund the people that "complained", some people wouldn't notice, and keep "the con" running much longer, "of course you don't know why worldpay keeps on charging your customers twice".

For the ones you "said" you refunded would have to wait for their next CC statement anyway, so in the majority that's almost 60 days of conning.

Hold on. Weren't these XSS measures supposed to make it more difficult to carry out fraud ? Not Easier:oops:

Anyway, great stuff Bigenuf, if RBSworldpay continues to be stupid, I'll include it as compulsory in the module, probably with a shop logo, since the current default's going to fall to pieces anyway.

Philip.

I've always been told if i Actually knew what i was doing i would be dangerous :cool: Glad i could help.

Bigenuf:

I've always been told if i Actually knew what i was doing i would be dangerous :cool: Glad i could help.

My wife thinks the greatest compliment I ever received was in a PM...

You have the mind of a criminal, thank God you're on our side

Title: ALERT: PayPal Direct Payment Error (10565 <!-- -->)
Content: 10565 Merchant country unsupported. - The merchant country is not supported.

This is an urgent matter. Above is the junk mail we received for many times in several e-mail of our companies, and that's all for the mail. We don't know either which site of our company it came from or which person. And we received e-mails from somebody complaining they had tried so many times to buy things from our sites but failed that they had to give up and buy from others.

Wonder what the matter is and what should we do. If anybody can help, we'll appreciate it very much.

:oops:

Since this little package i threw together seems to show people how they can con the system i will not be sending it out to anyone else. Disregard my previous post where i offered to send it out. Philip is the exception :clap:

Cheers,

Lake aka Bigenuf

kristina150:

Title: ALERT: PayPal Direct Payment Error (10565 <!-- -->)
Content: 10565 Merchant country unsupported. - The merchant country is not supported.

This is an urgent matter. Above is the junk mail we received for many times in several e-mail of our companies, and that's all for the mail. We don't know either which site of our company it came from or which person. And we received e-mails from somebody complaining they had tried so many times to buy things from our sites but failed that they had to give up and buy from others.

Wonder what the matter is and what should we do. If anybody can help, we'll appreciate it very much.

Why is this being posted on the WorldPay thread when it's either a ZC core issue or a PayPal Direct Issue ? Probably a good place to start would be finding the right thread, second thing would be finding out which country was causing the error, and it's not urgent for us and you're not paying for this service.

I have just installed Worldpay module on zencart 1.3.6 site and I am getting the following message when going to payment page.

Fatal error: Call to undefined method payment::in_special_checkout() in /home/MYSITE/public_html/shop/includes/templates/template_default/templates/tpl_checkout_payment_default.php on line 40

Any ideas please how to fix this?

Cheers

Rob

Bigenuf:

:oops:

Since this little package i threw together seems to show people how they can con the system i will not be sending it out to anyone else. Disregard my previous post where i offered to send it out. Philip is the exception :clap:

Cheers,

Lake aka Bigenuf
I really will include it, except I'll de RBS brand it (you'd probably not be allowed to have a page that could be mistaken for RBS on your website, I believe the term is "fraud") and use the ZC constants to link in a shop logo. "The con" exists regardless, I've explained to RBS that they are pillocks and that their anti-xss methods don't stop it. It's a part of their fundamental structure where they pull the page in rather than re-directing, as it's a lot more difficult to pull off the con if the URL in the browser window was "http://www.example.com" instead of "https://secure.rbsworldpay.com" (or whatever they've changed the damn thing to again).

What's that I hear ? the distant sound of the criminal community scrambling to sign for Merchant accounts.

Your code is sound, a good idea and is the only current alternative to have a really screwed up shop. The Con, well that's "their problem", hold on isn't that what they told us ? oh the irony.

robsnowden:

I have just installed Worldpay module on zencart 1.3.6 site and I am getting the following message when going to payment page.

Fatal error: Call to undefined method payment::in_special_checkout() in /home/MYSITE/public_html/shop/includes/templates/template_default/templates/tpl_checkout_payment_default.php on line 40

Any ideas please how to fix this?

Cheers

Rob

Upgrade to 1.3.8 NOT a facetious comment,

in_special_checkout

is part of the paypalwpp.php and paypaldp.php packages too and doesn't exist in 1.3.6

Hi Philip

Not taken as such - thanks! However my clients has so many mods that this may not be a sure fire success very quickly.

Is there any way to uninstall your mod for now? or is there an old version for 1.3.6 that I can use for now to get site back up and running?

Rob

Get the old 1.3.6 zip and overwrite the file. then disable the module. Should be the fastest fix.

That's the old Zen Cart 1.3.6 zip not worldpay, any other worldpay that would work on 1.3.6 has a big security hole.

Thanks Philip - this has sorted me out pro-temp!

I will have a crack at upgrading his site to 1.3.8a tonight when site is quiet and then try mod again.

Many thanks for speedy help.

Rob

[QUOTE=philip_clarke;781265]Why is this being posted on the WorldPay thread when it's either a ZC core issue or a PayPal Direct Issue ? Probably a good place to start would be finding the right thread, second thing would be finding out which country was causing the error, and it's not urgent for us and you're not paying for this service.[/QU

But we are using zencart, and it surely not of importance to you, but definitely to us, Just wanna find someone who can help. I'm not quite familiar with this, am I troubling you?

kristina150:

philip_clarke:

Why is this being posted on the WorldPay thread when it's either a ZC core issue or a PayPal Direct Issue ? Probably a good place to start would be finding the right thread, second thing would be finding out which country was causing the error, and it's not urgent for us and you're not paying for this service.

But we are using zencart, and it surely not of importance to you, but definitely to us, Just wanna find someone who can help. I'm not quite familiar with this, am I troubling you?

You need to post in the correct place, doing a search of the forum would help. Can't really understand why you think because you are using ZC that you have the some inalienable right to have people work for you for free; that troubles me, yes.

Read the licence the Zen Cart came with, it comes with no warranty. You have your instructions about how you might find help, now get off your ######## and leave my sitting room. (that's a metaphor or maybe an analogy).

philip_clarke:

You need to post in the correct place, doing a search of the forum would help. Can't really understand why you think because you are using ZC that you have the some inalienable right to have people work for you for free; that troubles me, yes.

Read the licence the Zen Cart came with, it comes with no warranty. You have your instructions about how you might find help, now get off your ######## and leave my sitting room. (that's a metaphor or maybe an analogy).

Ok, sorry then, thanks for your instructions, and no more trouble.