WorldPay Module for ZenCartv1.3x

Hi,

I'm having the same 302 problem as others. I could really use some help as a php5 upgrade brought down my payment system. It's not a high volume site but still...

WorldPay Java HTTP Request Object is attempting to acces and comes back with the 302, resulting in an error and failure of callback. I'd love some help. I just did a clean install of the module, applying Phil's new worldpay.php.

I tried to have a look in the database for oddities in the session table but didn't really know what to look for.

I'm not using ssl, btw.

Regards,

Niklas

Now have you installed the new callback password ?

In fact PM me and I'll have a look.

I am exceptionally unwell at the moment though, so be quick while I am still up.

Thanks to Philip for helping me out.

Turned out that WorldPay was not submitting the password. I tried entering the password into the test environment (as well as the production evironment) and suddenly everything worked. Very peculiar.

Yes that WP-thing is quite stupid in that way.

You can not change config in test environment, and you can not log in and then go to production to change this.

You have to log in to production first, change config there - and then enter test environment ... :)

Maybe I should clarify, in case someone else runs into a similar problem. the site has been live for a good year now. When I added the password to the production environment, I thought that was enough. It turned out, however, that I needed to add it to test environment as well.

Niklas

niklasalbin:

It turned out, however, that I needed to add it to test environment as well.

That sounds strange, and it's not what WP support told last time I had contact with them. But maybe they has changed it after that, since it was so stupid. :)

Good Evening/ Morning.

We now have a release of "secure" (depends on the person installing really) code, all in one zip file available from

http://exploitingIT.co.uk/WorldPay_ZC1.3.x_v1.01.zip

Install Instructions - unzip the file, copy the docs section into your shop. then go to http://YOUR_SHOP/docs/worldpay and they'll be more exact instructions. DO NOT COPY includes over until you have read the documentation.

Changes.

This is what I call an interim version. It is a compilation of the beta version and security fix Alan Duncan created and finished. It is then my improvements, a restructuring of the documentation so that it does not overwrite ZenCart's own documentation and licence and has one new feature plus some hooks for some others. It also features automatic SSL detection so no editing by hand of files should be required.

The new feature is Debug mode, where the server can email out whatever the WorldPay server is sending back to the shop. Never post a debug email to a forum, this is a fully written up feature that I've been using to help other people with their installations (I used to provide them with a substitute file that did much the same thing) and has proved essential to check that WorldPay is

• communicating with the shop and
• that it's sending the right passwords and MD5 (hence why you don't post this to a forum as everyone would know your password)

The reason I call it an interim version, is that in the next version people upgrading will not have to re-write their passwords and MD5 strings.
In the history of this module, with every upgrade the administrator has had to re-enter their details, plus I do not like the way that the passwords are on display to anyone walking past a desk.
There is a new feature at the moment, where if you have any files left over from the previous versions with possible security exploits; then the system will tell you so that you can delete them. During installation the module will try and get rid of them itself, but may not have the correct permissions, so it'll then annoy you to remove them.

Version 2.0 will perform a proper "upgrade" rather than re-install, version 2.0 will also analyse the server to see if there is anything likely to cause problems, and finally version 2.0 will fork into a version available here, and a SBD (Secure By Default) version to be hosted on my website. The code will be similar and also GPL, but whereas ZenCart's philosophy is to let the user choose, so the "normal module" will allow empty passwords or MD5 strings, the SBD module will disable itself until passwords and security features are filled in. From a database point of view, the normal version when upgrading will be the same as previous modules, so if the shop owner is running without passwords, so be it. If the SBD version is installed it will not "activate" until it is secure (thereby taking away choice in the interests of security).

From Version 2.0 a new thread will be started and this one will close. The security exploits and session problems of the past have been solved and it would be better if new users didn't have to search through 44 pages of irrelevant information to get some help or even file a new bug report.

Thank you
Philip.

Already a couple of bug fixes, all credit to Carl, one in the documentation where I forgot some people would be getting error messages because I forgot to set a variable. AND a more important one where the module now correctly generates a DECLINE response at worldpay but filling in the cardholders name as REFUSED.

This version is available from

http://exploitingit.co.uk/WorldPay_ZC1.3.x_v1.02.zip

and probably goes to show the importance of having a warning system when the module is out of date. ASFAIK the REFUSAL mechanism of this version may not work because I haven't tested it !

My concern has been to get Authorised transactions and callbacks working securely, so there may still be bugs in the system if someone's card is declined.

Thank you
Philip.

p.s. It also shows the need for a new thread Carl mentioned pages and pages ago that worldpay had changed it's decline mechanism and I have not read that far back into the thread and I am now responsible for the project !

New version at

http://exploitingit.co.uk/WorldPay_ZC1.3.x_v1.03.zip

only one change, unfortunately some legacy code was informing shoppers that though they had paid successfully, they were still in Test Mode, the correct emails were still going out, so they would t least of had some form of confirmation. Thanks to snowy2007 for spotting this.

Philip.

Sorry, I have been absent from the board for a while and not left any feedback.

One of my problems, identified by Philip was my slow hosting which didn't help things when trying to debug the module..

Any how, new host in place, I have installed the newest version from Philip as above v1.03. For whatever reason, it didn't work first time but by all accounts that was something to do with the way my hosting was set up and nothing to do with the module. Philip no doubt will fill in the blanks, on this.

To cut a long story short, with all the hard work and determination from Philip, initial tests of this module works!!! with MD5 and secure response......

I can't thank you enough Philip

Kind Regards
AfterHouR
http://www.allgoodideas.co.uk
Collectable walking sticks and canes for the discerning customer

I have installed the new mod ok and i can make a payment through the site.

However no order shows in my admin and the payment screen does not return back to my site after completion.

EDIT My fault, one missing passowrd and it appears to work fine now!

Glad you sorted it out OK.

I have made sure that my passwords in Worldpay test, match the passwords in production, as was mentioned in a previous post. I didn't want any ambiguities causing problems, I have had enough of those with hosting providers :)

Regards
AfterHouR
http://www.allgoodideas.co.uk
Wedding canes and stickmaking supplies

DVDTitan:

EDIT My fault, one missing passowrd and it appears to work fine now!

Pillock ! (I'm the author), use the debug feature next time and check if worlpay is sending the field callbackPW.

Hey Again guys.

Good job on the updated module. Discovered a few things I've missed.

Anyway, I installed the module on a 1.3.8 (as opposed to a 1.3.7) and removed all old files.

I set everything up according to your helpful documentation and tried a test transaction.... it goes back to how it was before. i.e. a thankyou page, but no callback to the old site.

When I get the debug email (awesome idea by the way) I get 'password failure' at the top. It's odd, since I've ensured that both md5 and payment response passwords are exactly the same.

Not tried the live one yet.

EDIT. looking at the above post, no callbackpw has been sent. What could cause this?

Hi thomasharding

Make sure the passwords in both envirnments of worldpay are the same, for instance you md5 and payment response in test environment are set to 123456, you must also have the same in your production environment ie 123456

I hope that helps

Regards
AfterHouR
http://www.allgoodideas.co.uk
[email protected]

Hi again.

Yeah, the test worked fine this time. The callback worked fine!

However, I'm back to square one again when doing the live transaction. I still get the "Money has not changed hands" message.

The debug email states that it was a success and it's passed everything through fine. I really do. not. know. whats going on!!!

Thanks again!

I know this isn't a fix but a workaround, if everything is going through fine look for that text in developer toolkit and edit out the text between the quotes, so it is not displayed on screen.

Hahaha, I never thought about that. Looking at things from that perspective, the order has gone through and shown up in the admin area, along with the payment to worldpay (which was authorised).

I've been having the same error message for like a month now, so by all means it could have been sorted long ago!

Must be a very complicated reason why it does that and an even more complicated fix, or a dead simple one if you are Philip....

But works for me ;)

Happy to help

Kind Regards
AfterHouRhttp://www.allgoodideas.co.uk
collectible walking sticks and canes