WorldPay Module version 2.0 - Support thread

philip_clarke:

they are charging £75 to unzip and ftp in my royal mail modules. Every few months someone finds this out and emails me, but because it's open source I can't stop it.

If you're talking about who I think you are, then there is a very clear statement on every product page that the fee is NOT for the module but for the installation and configuration.

haha no i think you would beat me to it......

Gotta update the client to the latest version of ZC, and patches and your latest module release as their previous guys havnt been keeping it uptodate

Have got a question, which you could probably answer me straight away....

Why do we need the base href tag anyway?
If you remove the base href tag, then the site will work fine anyway (obviously not in worldpay, as it needs it to be absolute urls), but on a general ZC site you dont need it surely?

Yes I believe there is, although I doubt many people ask what "installation" entails or "configuration". e.g

"We unzip a file and click an "e" for each module then "install"

Except that I don't think they click the "e" part as it's up to the client to choose and configure the charges for the service.

so that's 5 minutes work at £75, £900 per hour. Or 2 minutes work £2,250 per hour.

Ooba_Scott:

haha no i think you would beat me to it......

Gotta update the client to the latest version of ZC, and patches and your latest module release as their previous guys havnt been keeping it uptodate

Have got a question, which you could probably answer me straight away....

Why do we need the base href tag anyway?
If you remove the base href tag, then the site will work fine anyway (obviously not in worldpay, as it needs it to be absolute urls), but on a general ZC site you dont need it surely?

It depends "normally" on a ZC site it wouldn't be needed.

Occasionally you have some strange mod_rewrite rules.

Very very occasionally you have a linked in stylesheet that has an image in it, or includes other stylesheets. If one wanted to extend Zencart by using jQuery themes, then it would be very beneficial as the themes are built from one core file that needs to know where everything is, and css files only put in one request per item, whereas php could go "well if it's not there, then try...."

For the majority, you are correct, then you get the person that redirects their site from http://www.example.com/ using mod_rewrite incorrectly to http://www.example.com/store/index.php and the images are looking for http://www.example.com/ (because the URL hasn't got the store bit in it) when they are supposed to be finding them in http://www.example.com/store/ putting the base href at http://www.example.com/store/ stops that

Ryk:

If you're talking about who I think you are, then there is a very clear statement on every product page that the fee is NOT for the module but for the installation and configuration.

Look its' you, and your website

http://www.jsweb.co.uk/big-royal-mail-p-129.html

and this is what you write to make things "clear"

We remind you that the fee we charge is for installation and configuration of the module; where a module is a commercial offering, that fact, along with the cost of the module itself, will be made clear and we will also supply a link to the origin of that module in case you wish to purchase directly from the supplier.

Most of the free modules are available on the Zen Cart website.

Which makes it look like the module isn't free, might be commercial, and that the provided link is so they can buy it from someone else (probably me, except they can't because I don't charge for it). And I know I've never received a contribution or donation from you. At £2000 per hour, christ you're miserly.

Our 14 day money back guarantee (applicable to annual accounts only)

is illegal too, check the trading standards rules for distance selling.

philip_clarke:

Second thing, if my posts are edited or deleted again. I will withdraw my copyright on all modules. This is not a joke, it is the only option that an open source developer has and that will revert the WorldPay module back to the stage where it has a great big security hole in it and my royal mail modules will then not exist. The modules will also all need to be re-written if ZC version 2.0 gets released.

Philip.

Philip, while it's obvious that your frustration levels are high because of RBS nonsense, DON'T GO TAKING THAT OUT ON THE MODERATORS HERE!!!!

I've looked into what happened:
One of the moderators was cleaning up the duplicates of the PayPal-related posts that person made in "your" thread. While doing that they also saw your inappropriate choice of words directed at that person, and deleted it. They probably should have slapped you around at the same time for your own unsuitable behaviour. But they decided to be more kind than that.

So, there are 2 options:
a) you stop conducting yourself inappropriately to forum users or risk being banned for conduct unbecoming
or
b) allow moderators to do their job in peace

Now, let's just put the attitudes aside and go back to the regular discussion now.

Ban me. Withdraw all modules from the download area that I have authored, revert all modules that I have modified back to their previous state. That's total removal of the parcelforce and royal mail modules and you'll have to contact Alan duncan for the worldpay module to see what edits I did on the co-authorship of this

http://www.zen-cart.com/index.php?main_page=product_contrib_info&products_id=1148

since the original module with the exploit appears to have been deleted.

Good Bye.

I think this discussion just closed.

Oh dear, Oh dear. This kind of result proves my question about whether Zencart or any open source software is a good idea. If people get seriously fed up and are relied on, we are all sunk. Personally I was already having a very hard time before the Worldpay issue and on top of that the company I sell products for is now banning the display of prices on websites, I now have 4 whole days to design a working website. Perhaps I should say good bye as well. Why is it this all happens during the worst recession in history... I also think that if any wrapping of knuckles is to be done, it should be done privately and not in a forum. I wish everyone the best of luck.

Well, that is sad. I surely hope this is not the end of it and Philip does not quit on us. I for one, not a programmer, cannot re-code this on my own without proper instructions, also I do not make enough money on my store to be able to pay somebody to re-code this module - but I would hate to go back only to paypal... Unfortunatly for some of us there aren't that manyoptions for merchant accounts - the only one which allowed me to deal in 3 different currencies was WP - even if it is more expensive than other available solutions which offer less functionality. But if there is no other solution I will have to drop WP and try to find someone else after 6 months of having WP account.

It isnt too bad fixing it up to make it work for the time being with the thankyou page and cancellation page, the real problems would begin when worldpay release new updates and security holes that need fixing.

Also when ZC 2 is out, the whole module will need to be re-written anyway as no modules will work correctly

Ooba_Scott:

Also when ZC 2 is out, the whole module will need to be re-written anyway as no modules will work correctly

From what I have been told, ZC 2 will not be compatible with V 1.3.8a anyway (correct me if I am wrong).
Speaking to Philip it does not seem worth keeping the Worldpay module going in it present form even if they allow the base href tag as he exposed other holes in their system that if they fix them, the worldpay module will not work at all. Strange how other merchants don't seem to be having these issues yet they all have to be compliant with the new PCI rules.
:dontgetit

Yeh i think you are correct in the fact that ZC2 will not be compatible with 1.38a as the changes are fairly major......but it does mean every module will need to be re-written to be compatible with v2 (althougth some modules will be made redundant, as i belive some will become standard)

Im not to bothered if WP keeps or remove the base href tag now, as i have fixed up my site to work without it, and the thankyou/cancellation page now looks fine (well as fine as its going to get)
I have made the css stylesheets absolute URL's, and i have turned off the left/right columns and footer so it doesnt try to display images that can not be found.

Yeh i understand what you mean about it is isnt worth keeping the mod if they fix the holes and the mod isnt fixable....that would suck.

Be a hard conversation to have with my clients who already have Wolrdpay accounts :S

I know nothing about these other security holes mentioned but I can't help wondering if when they fix them they will affect all payments from any website and if that happens there would be so many people affected. As I still have 10 months of my annual Worldpay fee to use up I will use this module while I can. If they filter so much that it doesn't work before then, I will demand a portion of my money back. CAN ANYONE TELL ME if it is possible just to send the cart information to Worldpay, like you would with a simple HTML site, so that I can use Worldpays standard "Yes"html payment receipt page?

You can remove the callback <wpdisplay item="MC_callback"> in the worldpay production management area or uncheck the callback i forget which but the problem then as i can remember is that worldpay will not send back the cart info so you will not have a record of the payment unless you go into your worldpay account and even then you won't know exactly what they ordered or what shipping address they might have specified or the mode of shipping they also will not receive a receipt from your cart or an email or even a record of it in their account they can refer back to. They will receive an email from worldpay saying they paid a specified amount to you.
If i'm wrong please someone correct me.

My current HTML site still uses MC_callback. The customer gets a "Thank you" email using a script from the sendmail on my server confirming what they have ordered and I get a detailed email of product codes and prices, delivery address etc. Because of the whitelisting I have set the default Worldpay "Thank you" page to resultY.html (or resultC.html) receipt page. If I could just do this for my Zencart site I would be happy enough.:clap:

If that works for you great. But the only drawback i can see is that you open your shop up to a vulnerability that Philip found where people could send fake orders through your store and it looked like they had paid at worldpay. That was when version 2.0 of this module was born. So i will be just using a template override to compensate for the look of the pages and the security will stay in place as Philip designed it.

I don't know from the various suggestions which is the easiest method to get round the base href filtering (if they do enforce it). I don't want to hard code anything if possible and I don't want to mess up my site and not be able to figure out what went wrong. I guess that is why I back up my site and database every time I make a significant change. Perhaps I should pay Philip (I miss him already :( ) to sort me out...

I would hire Philip if your not sure otherwise,

Look back on page 39 of this thread and you will see how i have done it. Using the method i describe there all you are doing is making an override for the worldpay callback pages, namely the success page and failure or cancelled page. If you use the override then if worldpay do put the href back into the whitlist then just delete the folder and nothing in Philips module has been touched but if they don't put the href in then you can customise those 2 pages using the override and it will not effect any of your other zencart pages. You do have to hard code a couple of url's but nothing too dificult.

Lake