WorldPay Module version 2.0 - Support thread

I'm in the process of moving my shopping cart from ePages to Zen Cart. I first installed the Worldpay module in Zen Cart at the beginning of September, and have been successfully running it in test mode. I tested it last night and this morning and Worldpay payments are no longer working. It is failing at the callback stage. The last time I tested it was on Tuesday morning and everything was fine. When I test it now it fails and I don't even receive failed connection emails from Worldpay, which is worrying. I am using the following for my callback URL: https://<wpdisplay item="MC_callback">

I have tested connections from outside to my server on port 443 (https) and that is OK. I have not made any changes since Tuesday.

Are any other Zen Cart Worldpay module users having problems, or is it just me?

Hello all.
For those who have not been following this thread, there have been some irritating developments in the last couple of months on Worldpays side where they are filtering various parts of the code causing callback problems and display problems.

I would suggest you read (as tedious as it may be) all the threads from about http://www.zen-cart.com/forum/showthread.php?t=112021&page=31 onwards...

The designer of this Zencart Worldpay module Philip Clarke is not able to respond on this forum unfortunately.
Sorry I cannot be of any help but you may learn something from reading the past posts.
I believe Worldpay are still working on the issues and personally I am waiting till they have finished what they think they should be doing to conform to the new XSS and PCI rules. Peter

I have been following this thread since early August (since before entry #31). Is anyone else experiencing callback failures? if anyone currently has callback success (even if it is with badly formatted page) that would be very useful to know. Any information will be greatly appreciated.

Hi wilorc,

I read your post late last night and it got me worrying as i also only checked it afew days ago and it was working a treat....

...tested mine today and it worked fine, and my page is loooking pretty hot aswel.....so no callback failures for me unfortunatly

your callback you showed looks correct to me, and i cant think of anyreason why yours isnt working.

Brain is fried today, will try and think about a possible reasons or things to try this weekend if you havnt already fixed it.

So your site is sitting on a SSL? have you made any changes to the callback_success pages, or any other files? maybe you accidently made an error somewhere?

Your errors on the ssl may be due to the fact worldpay are fiddling again? have you tested it again today?

nescaya - have you managed to fix your problems?
Have you made any changes the callback files? im assuming you have got a wp_callback_success page?
Cus maybe it cant find it so it defaults to your index page?

So your not on SSL?, what is your callback text your using? have you checked to make sure that is correct?

Have you changed any of this modules files recently, or added any weird and wonderful mods that could be affecting it?

Sorry guys im just throwing some ideas out there,.....hopefully we can help get you sorted and fixed without our knowledgeable leader! :S

Hi Ooba, I have now got WorldPay returning the right page and Zen Cart recording the order. You were right - I re-uploaded the sucess, cancelled and process wp files and got the right response. Thanks for your suggestions.
Now my only problem is understanding the formatting problems of the success and cancelled pages - which look appalling! As an absolute newbie to this subject with limited programming skills, can you or anyone tell me simply how to make it look presentable. I have read that WorldPay is stripping part of the formatting - but have not understood what I can do about it. Also - bless their hearts - that they are changing it again very shortly. All help really appreciated.

Coool glad you got it returning, thats a good start :)
Yeah it being a mess is a real pain in the bum.

Afew posts back i posted how i managed fixed my and get mine working well.

My solution envolved Bigenufs previous fix (page 40 ish i believe), but he had to reverse his fix in order to gets his to work correctly.
So think the solution needs to be tailered abit per zen cart as some seem to be acting slightly differently

When you see your thank you page, is it picking up the stylesheets and images?

Does it look like everything is sitting ontop of each other......if this is the case you may be able to use my solution.....but it does involve opening up some files and editoring some files.

Abit of background on WP, the way they work on returning the thank you page, is that they 'suck' the thank you page in. so pull in all the code for it.
Zen carts use a tag called 'base href' which adds your url 'www'yourdomain.com/' to stylesheets, images, etc. But WP decided this tag was bad and would filter it. This meant your thank you page would have no styles or images as it was trying to locate them on WP's server. They also were filtering out </li> tags and </option> tags

After many complaints from us zen lot, they now pull in all these tags so your site should pick up styles and images again. although they have now started to add self closing ( /> ) tags to divs ....but not all divs just the odd one or 2.

I debugged the code of my thank you page and found out if i removed a chunk of code then the page would then become un cramped and look normal again. This was the main navigation , but as i still had sideboxes on then it isnt a problem for them to navigate back to your site.

Ok sorry for the long reply.......if this sounds like the problem your experiencing im happy to write a 'quick' guide on how i remedied this which may be useful to yourself :)

Hi Ooba. The customer gets two options for format (because the information is not coming from a https:??). The version which is 'delivered securely' does not hold the fomatting for the side boxes or have any images and comes out in huge print; or the version that is 'insecure' holds the side boxes and images - but still has larger print. As none of the information is very confidential that is displayed - its a pity that WorldPay has to make the distinction. I have seen this situation on other sites and my guess is most purchasers will choose the 'secure' option with extremely large print and no images.
I would be happy with a sucess page that just has a simple message and a hyperlink to the home page. However, I suspect this means substantial editing to the template.
I'd really like to see a quick guide if you have the time. Otherwise I could live with what I've got provided the text size wasn't aimed at someone extremely longsighted!

hey nescaya, i see you mentioned they get two options secure or non-secure. If this is the case im about 98% sure you are doing your test transactions using Internet explorer 8? As this message only pops up with this broswer......if you use Firefox or safari then you dont get this message.

There is a setting in IE where you can turn this message off, but u cant guarantee your customer will have it turned off (i discussed this on the previous page i think)

If i use IE to test , and choose ' yes only show stuff from the secure connection' then i have no styles or images etc, but if you choose 'no' then it is all tickety boo .

Yep your right about it not all coming from a secure site, some is and some isnt, and IE flags this for you and doesnt like showing mixed content. But as far as i know there is no way to avoid this as the pop up is turned on by default.....

.....You could however get an SSL and move your shop to there?!?

I may end up having to do that myself if my client insists on it, but im not too worried as by the time they see that page, your shop has recieved the order and WP has taken the money.

Ok cool, i will gladly try and provide a quick mini guide of what i did.......will have to try and do it tommorow/monday tho :(

It is already in this forums, spread over a fair few pages.....but would probably be good to try get the solution that worked for me all in one post

i finally got a email back from Worldpay today, and they said most of the XSS and whitelist changes should be in place by september 30th (i wouldnt hold your breathe though)

And he will email me next week with a exact list of changes that have and will be made

........but im sure i will have to email them first to get that!
I Shall put the info whenever i get it :)

Ooba and Bigenuf, you have been very good in the absence of Philip but frankly this is all really starting to wear me down.
I did the Worldpay override folder thing so that the receipt page displays ok and it works OK in Internet Explorer as long as you tell it to display secure and non secure content BUT in Firefox, it will not display the stylesheet information.
It does not work at all anyway if you remove the base href tag in html_header.php
Until I can get past these problems, there is no point in going any further.
I have emailed Philip but I fear he will not wish to help or it will be for a fee which I cannot afford.
I am wondering whether to cut all the aggravation and just use Paypal.
I have read all these new posts from people with all their problems and with the uncertainty of whether Worldpay have finished their ridiculous filtering or not, I can't see an end to it for a long time.
Those of us who do not know much about PHP or sessions blah blah blah, are just left groping about in the dark. I now have 1 day to design a completely new website before I can no longer use my old working one that displays prices :frusty:

you need to keep the base href tag in html_header now. Worldpay stopped filtering the base href tag now lol.

Your say it doesnt work in firefox.... what does it look like? so not styled at all? is that because you removed the base href tag?

is it all bunched up? if it works in ie i would expect it to work in firefox.......have you got a screenshot of what it looks like in both?

Have you done view source in both browsers and tried to compare them to see if anything is different.

Also pete, did you say that you are no longer able to display prices?

Cant you just turn prices off or turn the shop into a 'showcase' so you dnt see the prices........saves re-designing a new site.

I think changing it into a showcase site would be pretty quick and painless

And you may aswel use paypal aswel....quick and easy to set up and at least it is one payment option for your customers to use while you are sorting out your issues with worldpay

With a standard module, with all of the options installed correctly and the callback set up correctly, does anyone have one list of outstanding issues ?

As far as I can see, Worldpay did what I told them to and put the base href tag in, so the issue remaining appears to be that javascript CSS menus aren't wroking (that's almost certainly never going to work because they were banning the script tag), and that mixed content is being banned, e.g. SSL from worldpay mean not pulling in non-ssl items from your website if you don't have a certificate, whihc would be stylesheets and images.

There also appears to be some problem with the footer and div's being stripped if they are empty ?

Philip.

Hi all,

I've been lurking here for quite a while now.

I'm not too good with coding and scraped through by trial and error so I'm not going to be a great help but I have a couple of points:

My store's been running over 2 years and I didn't upgrade to Philip's newer WorldPay module - it is still using the old url's to their servers rather than the rbs versions. Strangely the shop still seems to be functioning fine although I do have the whitelisting set to off. Customers come back and continue navigating correctly. And no feedback with complaints. I've no idea why I've escaped but maybe someone can see a clue or direction to work towards?

I know I'll need to change very soon but I'm waiting until the very last until all the stupid changes are finalised.

Petelutonuk - I've got "The book". I had a quick look through and it might have a bit of help for your unusual situation.

In Admin>Configuration>Customer details, there are two separate options (about lines 12 and 13 on my setup)

Customer shop status
Customer approval status

I believe changing these options should work for you

In particular "Customer approval status" has a choice "may browse but cannot see prices until authorised"

Best of luck hope it does the trick.

Cheers

Dave Clarke (no - definitely no relation to Philip)

Some Bloke:

Hi all,

I've been lurking here for quite a while now.

I'm not too good with coding and scraped through by trial and error so I'm not going to be a great help but I have a couple of points:

My store's been running over 2 years and I didn't upgrade to Philip's newer WorldPay module - it is still using the old url's to their servers rather than the rbs versions. Strangely the shop still seems to be functioning fine although I do have the whitelisting set to off. Customers come back and continue navigating correctly. And no feedback with complaints. I've no idea why I've escaped but maybe someone can see a clue or direction to work towards?

I know I'll need to change very soon but I'm waiting until the very last until all the stupid changes are finalised.

You'd better not publish the location of your shop. The reason why version 2 of the module was created is because it's possible to fool your shop into believing that items have been paid for and approved by worldpay with the first version of the module. It's also possible to discount items by knocking of xx% amount where worldpay would then also send you items have been paid emails, and unless you check every amount it's very easy to execute fraud.

Philip.

philip_clarke:

You'd better not publish the location of your shop. The reason why version 2 of the module was created is because it's possible to fool your shop into believing that items have been paid for and approved by worldpay with the first version of the module. It's also possible to discount items by knocking of xx% amount where worldpay would then also send you items have been paid emails, and unless you check every amount it's very easy to execute fraud.

Philip.

Thanks for that Philip, I didn't realise it was quite that bad. In my situation (I sell very few items and price adjustments would stand out very clearly) I feel less worried about the second scenario but the first one sounds pretty scarey.

Would worldpay's payment confirmation email be tricked as well (I always check that the shop's and Worldpay's email payments agree)

i.e. would it be ok to wait a week or two for the complete solution or should I treat it as an emergency.

Nice to see you back.

Dave

The chances of someone doing this to your shop are small, not because it's not possible, but because the user base is not that large and the criminal community never paid that much attention. The worldpay email can be faked very easily to say that payment's been made and the details that a criminal would need would all be on your shop. If you don't want to upgrade then I suggest that with each order you log onto worldpay to confirm each order and that the order has taken place.

Philip.

philip_clarke:

The chances of someone doing this to your shop are small, not because it's not possible, but because the user base is not that large and the criminal community never paid that much attention. The worldpay email can be faked very easily to say that payment's been made and the details that a criminal would need would all be on your shop. If you don't want to upgrade then I suggest that with each order you log onto worldpay to confirm each order and that the order has taken place.

Philip.

Hi Philip,

Thanks for the clarification.

Do you think there is any link between my apparent lack of problems (with visual rendering etc.) due to still using their old servers or is it just co-incidence. I'm a bit worried about making changes that might need several tweaks - I'd rather do the whole thing in one go and get it over with.

Cheers

Dave

Some Bloke:

Hi Philip,

Thanks for the clarification.

Do you think there is any link between my apparent lack of problems (with visual rendering etc.) due to still using their old servers or is it just co-incidence. I'm a bit worried about making changes that might need several tweaks - I'd rather do the whole thing in one go and get it over with.

Cheers

Dave
The old servers were supposed to be turned off and could be at any time. There was a message about it some time ago, this year we're are on the third location for their servers where the module has had to be altered, so at the moment you are running on a machine that shouldn't be there and could be turned off at any time plus since they appear not to be applying the whitelisting rules to that machine (as you have no rendering problems) I wouldn't be surprised if everything just disappeared one day since they did give a long notice period.

On the plus point, WorldPay didn't break the zen cart that badly, the Romanian Hacker Unu, who recently got into an argument with them, also found that the modifications caused a sql injection vulnerability in one cart (fastcart, never heard of it myself), which is detailed here

http://unu1234567.baywords.com/2009/09/12/fastcart-co-uk-sql-injection/

and that might be the reason why there are legacy machines still out there, yep, use freecart, worldpay upgrades, and allows a hacker to attack your shop and steal the other customer's data, now that is an upgrade policy and a half.

Philip

Anyway I think I'm off now, Wilt's (hello) looking at this thread so I'm probably flagged and I can't see any thing outstanding that suggests that the module isn't working. The script tag's not going to work so css menus are out, and the SSL warnings will vary from computer to computer depedning on what your customers are using so everyone's going to need to buy a certificate. (the other option would be me hosting the stylesheets on my secure server on a per person basis) I wouldn't recommend using a cheap certificate as you'll find that if you pay godaddy then you get a subdomain like your_shop.godaddy.com which can cause further problems and has been dcoumented on other parts of the forum.

The only issue with getting a certificate yourself will be your website hosting company installing it if you are using budget hosting, for which they'll probabbly charge a hefty fee for restarting apache.

bye
Philip.