WorldPay Module version 2.0 - Support thread

One of the fourm administrators has been deleting my posts, the last time my posts were edited I left the entire project for 2 years.

Philip.

philip_clarke:

One of the fourm administrators has been deleting my posts, the last time my posts were edited I left the entire project for 2 years.

Philip.

Any reasoning for the edit/delete? Was it the Worldpay thread?

It would appear that the administrators objected to me telling the lazy woman that posted here, that she had an "urgent error" (it wasn't urgent, they apparently have been receiving emails about mistakes in their shop for some time, so it was only Urgent whn someone told her she should have sorted it out) which was nothing to do with worldpay, and I told her to find the right thread (I guess the thread was near the top of the forum list because of recent discsussions), then I told her to search for the right thread and go away after she continued posting.

I have very little tolerance for lazy people that expect me to sort out their problems for free, and shirk responsibility, post in the wrong thread and can't be bothered to search. (hence the contrast un my attitude between that woman and the bloke above with ZC 1.3.6 who got a rapid reply)

Two interesting points.

Within the last hour I received an email from RBS today offering me a developer account. I said it is pointless unless they are going to change the system to stop the kind of fraud I demonstrated (as I'd have to rewrite the module). I also told them that base href has nothing to do with PCI DSS after a client has paid, since PCI DSS is also to do with information leakage on "their" website, not information on a zen cart website.

Second thing, if my posts are edited or deleted again. I will withdraw my copyright on all modules. This is not a joke, it is the only option that an open source developer has and that will revert the WorldPay module back to the stage where it has a great big security hole in it and my royal mail modules will then not exist. The modules will also all need to be re-written if ZC version 2.0 gets released.

Philip.

Well trying to look on the bright side, maybe they, RBS, are taking you seriously now. Was that a pig i just saw fly past my window???

Philip, I think you have been very patient, I can feel your frustration and I wish I had your knowledge. Please don't leave us just as Worldpay seem to be taking notice. With your persuasion perhaps they will cooperate and we wont all have to bodge our sites or cancel our Worldpay accounts.

I have a bigger problem right now...found out by chance last Thursday that the company whos products I sell on my website are banning anyone from displaying prices on their websites from October 1st... unless the customers are logged in. OK, I can do this with Zencart but I cannot design a complete working site in 2 weeks around my full time job and I have only just started. :yuck:

I guess this forum should be used to help sort problems between us, I pray that this big problem will be sorted out A.S.A.P. Peter.:smile:

Oh I doubt it, I fully expect RBS not to do anything until someone commits a large scale fraud multiple times over, they'll bury it the first time or two until it becaomes common place and then they'll do something truly bizarre. I know (in great detail from a senior civil servant about an exact ongoing scam) that the banks routinely write off fraud rather than fix the system, as it would cost more to fix apparently, but then they are way over quoted on price all of the time and seem to require 5 times the people to do a one person job.

I've no idea if they've fixed the XSS exploits from the 1st September either, I'll probably pop back next week, at which point they will have been charged several thousand pounds to alter one line of code, just to check. I'm just not really interested any more, after having been ignored for so long, it is almost impossible for me to summon any more desire to work on a gateway that brings no rewards fiscal or otherwise.

Philip.

petelutonuk:

I have a bigger problem right now...found out by chance last Thursday that the company whos products I sell on my website are banning anyone from displaying prices on their websites from October 1st... unless the customers are logged in.

Shouldn't be that tricky, I'll do some research.

Sorry incorrect post

petelutonuk:

I have a bigger problem right now...found out by chance last Thursday that the company whos products I sell on my website are banning anyone from displaying prices on their websites from October 1st... unless the customers are logged in.

in the file includes/functions/functions_prices.php

there is a function zen_get_products_display_price.

At the bottom, if you alter the return value to only display a price if the user is logged in, then you'll have done it.

(hence why I'm a £80+ an hours developer, because it saves you a lot of money and time).

Electrobumps:

I've installed the Module, all the options appear in Zencart.

However when I try and activate them they go to the amber light. Not green.

I get the message about updating postage costs, but can I actually try out this add on without paying for the postage costs to be updated?

Am I doing something wrong?

I'm happy to do this if I like the way it integrates with my site and feel in is beneficial.

Are you talking about a different module ? as opposed to the worldpay payment module ?

Worldpay want me to release a patch. I have explained to them that different people use different templates and that I can't patch every template.

EDIT:

So that would be worldpay wanting me to work for free, too.

Quote them your going rate and i'm sure you would be alot more cost effective then who they use now and get it done alot faster. They should hire you as a consultant. Well worth the money in my opinion. I'm sure they have alot of their tech stuff farmed out overseas.

I'd only be interested in a directorship nowadays, it's a lot better use of my time to tell managers what to do and decide the policy from a knowledgable position, but unfortunately I didn't go to the correct school, university, army regiment, political party, or sit on the board of a failed company.... Hold on, aren't we in a recession because of board members that went to the correct school, university, army regiment, political party, or sat on the board of a failed company ? Ah, I'm starting to see a pattern there.

Yep that's right. It's not what you know but who you know.
I dare say i never even made it that far.
Self taught and dangerous:rolleyes:

I've been having a play around with a program. IF RBSworldpay go against all the recommendations and continue to remove the base href tag when they make made white-listing compulsory, I believe I can fix each shop on on a shop by shop basis. I think it will take about 45 minutes and will require ftp and admin access plus the shop will need to closed down for that period of time. The alternatives are:

• Give up worldpay
• Recode all of the links yourself
• Pay a freelancer an hourly rate to recode them
• ermmm...

Basically if work is not done, then the payment pages after received funds will fall to pieces as show on the preceeding pages. It can't be built into the module because everyone uses different templates. Because I know the system, I've written a small diagnostic program that would enable me to target any system but would still involve me doing it by hand. I believe that I could do this faster than anyone else. (and without buggering anything else up)

If RBSWorldPay do pay attention and leave the base href tag in, then this work will not be necessary. You should also note that if your template is reliant on javascript for anything, mouse effects, menus, page counter, pop up images... then these items will never work on the end page at worldpay's website as they'll never allow a script tag through, although thsi shoudl not be that much of a problem as the current end page for the worldpay template doesn't display any "you might be interested in these items.... kind of page that could have required a pop up".

Also anything like the end of list items or option tags that may currently be "damaged" by worldpay's actions cannot be fixed, as there is a big difference between me running a program that can go through your templating system and at http:// etc... to all the links, images, style sheets etc... and worldpay ripping a section of your webiste out (which is what they are doing with the <base> and end tags for </li> and </option>).

Philip.

What alot of people don't take into consideration is that there are thousands of carts out there that this will effect.
Not just zencart carts.
Anyone using the callback will have problems.
Most people will not see the effects of this until a shopper tells them their pages are a mess or the confirmation email they and the customer receives is a jumbled mess. This is caused by the lack of a css stylesheet because worldpay rips the link out. The carts will still work but customers will lose confidence in you and your site when it's a mess thus losing customers.

Most people don't have the skills to even attempt to fix this problem and if you hire someone, other then Philip, to fix the problem it will take them hours if not days to figure out what to do.

The domino effect will soon be in force and worldpay will be the ultimate loser but then again don't we own a majority of RBS? So it's our money they are wasting even if we don't use worldpay the British taxpayer will once again pay for incompetence.

Well i'm lucky at this point because i know how to fix my site but anyone else i would urge to contact Philip if they need a fix otherwise we wait until D-Day and see if the forum gets swamped with this problem. I would also urge anyone with a worldpay account to complain to them in the strongest manor.
This is not a zencart or module problem it is a problem that worldpay has conceived themselves. They haven't thought through the ramifications of their actions or lack theirof.

Too early to get on a soap box i'm getting dizzy.

Cheers, Lake

I was one of the first to spot this impending catastophy in July / early August. I have been watching the posts and sending my own communications to Worldpay here and there.
Today I have received another weak response saying that they are still working on the problem...as if we didn't know!
I have re-iterated the problem and stated that if they go ahead and filter the base href tag, I and hundreds more will be cancelling our Worldpay accounts and going to other merchants, which there are plenty of and that will work with Zencart and that as far as I can see, seem to be cheaper.

I have not got the time, the knowledge or the money to pay anyone else to sort the problem out. I am also now wondering whether Zencart is actually a good idea, at least if you buy a product it would be up to them to bring out modifications as they would have the incentive to do it. Like Philip said, he gets no reward from doing this, let alone all the hassle with this forum alone. I think the whole world is going to hell in a hand cart.:frusty:

Hi Guys, sorry i havnt been active on this thread recently, work has been manic.

I have fixed my worldpay callback pages, by using aboslute URL's and removing the left/right hand columns (as they contain images), and also removing the footer as this also has an image.

I personally think this looks fine for me and im happy to have it like that.

I just now need to remember to replicate it on a new clients zen shop as he also has worldpay :( and he was unaware of all these changes happening at worldpay end

I just need to make sure i remember what changes i have made etc haha.

Phillip just gotta say i think you are doing a grand job as always!

I estimate that there are at least 1000 shops using RBSWorldPay as their primary gateway, based on the number of downloads and that some of the downloaders are designers re-using their code.

@bigenuf - the appeal of zen cart is that there are a lot of people who do it themselves, they also have very outdated carts and are sitting ducks with the recent security exploits, there are some DIYer's that PHP/HTML wise, are as skilled as the average web designer, and then theres are developers. Designers' nice chaps, can do things I can't like design things to look pretty, most have a very limited knowledge of PHP structure let alone the more complex Object Orientated things. I get sub contracted quite a bit because of this. The better DIYer may be able to put something together, what concerns me is that a lot of people have had their site designed, so will go back to the "designer" who then might try and do it themselves, spend a lot of time and the client's money etc..

Actually I should have stuck a big sign in admin saying "check the forum first" but the designer's would probably remove it.

Then they'll be the people that try and get a cheap option off some freelance websites, which IMO is really quite dangerous because of the lack of knowledge or reputation I once was asked to look at something while a team from an Eastern European country were working on the same website, the team were explicitly told they couldn't have database access but had just read the config file and appeared to be downloading email addresses presumably to sell off as spam, while someone else was uploading illegal films. This isn't saying that there aren't trustworthy people in the Eastern European countries, but if they are offering a really low price they may be making money elsewhere like by selling lists, so reputations have to be checked very carefully.

I do break into websites including banks and governments, I also use my own name and don't hide anything I've done. I'm more of a strategist than a hacker as I do it to show what could be done, like poison the UK or commit relatively simple frauds, and mostly the results are that the internet is a safer place, unless of course you get WorldPay ignoring everything.

@peltonuk - Out of the open source shops, ZC is the most secure, osCommerce, the parent is now so full of holes with little maintenance that in parts of the site you only have to hit the enter key to commit fraud. The issue is that by usnig a base href tags, template designers didn't need that much PHP code, they didn't need to work out for each image whether the server has in the HTTPS or HTTP side (because if you ######## that up IE gives an insecure item warning) and that led to more flexibility as more lower skilled people could access the project from the start and grow to be better developers. The "problem" with commercial shops is the License agreement, which tends to go, "it's not our fault", so even if this comes up, then they don't have an incentive to fix it and they would charge. Also then there is the issue of contacting the shop owners, a lot of shops are installed by designers, shop owners then up paying middle men.

A cracking example is that there is one zen cart approved host that a) I had to tell them how to configure their server because they don't come from a systems' admin background, b) they are charging £75 to unzip and ftp in my royal mail modules. Every few months someone finds this out and emails me, but because it's open source I can't stop it.

Anyway everything would be better if the base href tag was kept in, they are allowing external style sheets too, there are attack vectors based on that also, in fact I can't work out any logical reason why they are picking on that tag. I think that they probably should have employed someone to RTFM before they decided on these decisions, for one thing they are using the specification that is listed as

Example policy file (far too permissive for production use)

I think that paypal charges about £20 a month for a virtual terminal service as well as the other features that WorldPay operates, the only thing they don't do is have a real terminal like you would swipe your card through in a shop, which I think you can extend the option with RBS, but if HSBC were to do a partnership then (or Google were to buy a physical bank which would be a good tactic since their checkout has never really taken off) ... actually I can't think of a reason why one would want to stay with worldpay even if they were to leave the base tag in, can anyone ?

Ooba_Scott:

I just need to make sure i remember what changes i have made etc haha.

Phillip just gotta say i think you are doing a grand job as always!

Ha, what job, I'm just waiting, If they leave the tag in, then this whole discussion's been for nothing but I may just close the module anyway as I can't think of a reason to leave it running. When ZC 2.0 comes along the module would have to be re-written anyway.

If they don't leave the module in, I expect I'll get one or two sites repaired while a lot of people leave worldpay when they find out what has happened, or those people will get ripped off and charged far too much money for a repair to their website.

Want a competition ? I reckon I can fix the pages in 45 minutes on your client's website, that the pages will never throw an error and look identical to how they were before and include all images (my test program identifies the key points in the entire site :smartalec: ), no it's not really fair is it ? :D