Forums / Addon Payment Modules / NMI payment module broken after installing hack-protection suggestion

NMI payment module broken after installing hack-protection suggestion

Locked

Views: 1,929

Results 1 to 7 of 7
This thread is locked. New replies are disabled.
20 Nov 2009, 1:13 AM
#1
greengecko avatar

greengecko

New Zenner

Join Date:
Sep 2008
Posts:
13
Plugin Contributions:
0

NMI payment module broken after installing hack-protection suggestion

https://www.zen-cart.com/tutorials/index.php?article=320
This patch breaks the NMI payment module on 1.3.8a.

I spent hours chasing this down and then confirmed that the patch was the problem.

Just letting others be warned and maybe saving them time.

20 Nov 2009, 1:48 AM
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: NMI payment module broken after installing hack-protection suggestion

GreenGecko:

This patch breaks the NMI payment module on 1.3.8a.

"breaks" is an EXTREMELY general statement.
Perhaps you can elaborate more.

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

20 Nov 2009, 1:45 PM
#3
greengecko avatar

greengecko

New Zenner

Join Date:
Sep 2008
Posts:
13
Plugin Contributions:
0

Re: NMI payment module broken after installing hack-protection suggestion

When I applied this patch, at the finial confirmation of purchase,
NMI would receive all information (confirmed) but the the redirect within the shopping cart would produce a blank page (no source code at all).
However in the browser address bar would be the accepted, rejected return with + sings between each word.

How I traced the down was doing a clean fresh install of 1.3.8a and stated adding in any changes to the clients site one at a time. This patch was the one.

21 Nov 2009, 7:12 AM
#4
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: NMI payment module broken after installing hack-protection suggestion

GreenGecko:

When I applied this patch, at the finial confirmation of purchase,
NMI would receive all information (confirmed) but the the redirect within the shopping cart would produce a blank page (no source code at all).
However in the browser address bar would be the accepted, rejected return with + sings between each word.That's the important information. It's always best to include the actual problem you're trying to solve when asking for help, rather than only talking about the solution end.

You have 2 options for fixing your situation:

  1. Remove that patch and suffer the consequences described in the intro text posted with the patch.

  2. Edit the outdated payment module to have it use the $messageStack for passing messages instead of passing them on the URL:
    line 120, change:```
    if ( ($result == false) || ($result < 1) ) {
    $payment_error_return = 'payment_error=' . $this->code . '&error=' . urlencode($error) . '&gateway_services_cc_cc_owner=' . urlencode($_POST['gateway_services_cc_cc_owner']) . '&gateway_services_cc_cc_expires_month=' . $_POST['gateway_services_cc_cc_expires_month'] . '&gateway_services_cc_cc_expires_year=' . $_POST['gateway_services_cc_cc_expires_year'] . '&gateway_services_cc_cc_csc=' . $_POST['gateway_services_cc_cc_csc'];

     zen_redirect(zen_href_link(FILENAME_CHECKOUT_PAYMENT, $payment_error_return, 'SSL', true, false));
    

    }
    to this:
    if ( ($result == false) || ($result < 1) ) {
    [B] global $messageStack;
    $messageStack->add_session('checkout_payment', $error . '<!-- ['.$this->code.'] -->', 'error');
    zen_redirect(zen_href_link(FILENAME_CHECKOUT_PAYMENT, '', 'SSL', true, false));
    [/B]
    }

and line 228, change this:```
    function before_process() {
      if ($_GET['response'] == '1') return;
      if ($_GET['response'] == '2') {
        zen_redirect(zen_href_link(FILENAME_CHECKOUT_PAYMENT, 'error_message=' . urlencode(MODULE_PAYMENT_GATEWAY_SERVICES_CC_TEXT_DECLINED_MESSAGE), 'SSL', true, false));
      }
      // Code 3 is an error - but anything else is an error too (IMHO)
        zen_redirect(zen_href_link(FILENAME_CHECKOUT_PAYMENT, 'error_message=' . urlencode(MODULE_PAYMENT_GATEWAY_SERVICES_CC_TEXT_ERROR_MESSAGE), 'SSL', true, false));
    }
```to this:```
    function before_process() {
      if ($_GET['response'] == '1') return;
[B]      global $messageStack;
      if ($_GET['response'] == '2') {
        $messageStack->add_session('checkout_payment', MODULE_PAYMENT_GATEWAY_SERVICES_CC_TEXT_DECLINED_MESSAGE, 'error');
        zen_redirect(zen_href_link(FILENAME_CHECKOUT_PAYMENT, '', 'SSL', true, false));
      }
      // Code 3 is an error - but anything else is an error too (IMHO)
        $messageStack->add_session('checkout_payment', MODULE_PAYMENT_GATEWAY_SERVICES_CC_TEXT_ERROR_MESSAGE, 'error');
        zen_redirect(zen_href_link(FILENAME_CHECKOUT_PAYMENT, '', 'SSL', true, false));
[/B]    }

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

21 Nov 2009, 3:42 PM
#5
greengecko avatar

greengecko

New Zenner

Join Date:
Sep 2008
Posts:
13
Plugin Contributions:
0

Re: NMI payment module broken after installing hack-protection suggestion

Thank you DrByte for your fix for the "outdated" NMI module to be compatible with the afore mentioned patch.

I wonder if altering their code would violate any agreements with NMI?

I will apply your fix and then add the patch back in once I talk to NMI and resolve another issue I'm having.

Free shipping coupons and restricting them to only one shipping method.
I found a relevant post and I'm working on a solution.
But I'm getting the opposite results than expected.

Should this be dealt with in that post or this one?

21 Nov 2009, 4:41 PM
#6
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: NMI payment module broken after installing hack-protection suggestion

GreenGecko:

I wonder if altering their code would violate any agreements with NMI?Not if you're using the one hosted in our Free Addons area, since everything there is released and licensed under GPL.

GreenGecko:

... once I talk to NMI and resolve another issue I'm having.

Free shipping coupons and restricting them to only one shipping method.
I found a relevant post and I'm working on a solution.
But I'm getting the opposite results than expected.

Should this be dealt with in that post or this one?
It doesn't sound like that issue is a problem with the NMI module, so should be dealt with separately.

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

17 Feb 2010, 3:43 AM
#7
silvalex avatar

silvalex

New Zenner

Join Date:
Oct 2009
Posts:
11
Plugin Contributions:
0

Re: NMI payment module broken after installing hack-protection suggestion

I have the same problem. The code changes suggested didnt help. Any other ideas?