WorldPay Module for ZenCartv1.3x

Hamish,

It's not necessarily a link to an image that is the problem - that was just my guess. But at least one of the links from your page should be HTTP for you to get this message so search for the string 'http://'

Have you got an URL to let me have a look?

Bummer about your PHP version!

Regards,

Alan

Hi Alan,

Thanks for your prompt reply. My site is at https://www.styleforhome.co.uk.

Any help would really be appreciated.

Thanks again.

Hamish

Hamish,

I did have a limited look at your site - it's live so I wasn't able to complete a transaction. I did not get the "unsecure items" meassage at an time although I did process a purchase as far as the WorldPay gateway before cancelling.

Searching the source code for 'http://' I found several links, but these are not the problem since they do not bring actual content to the page but are links away from the page. All of your image links seem to be relative so shouldn't be the cause of the problem as I understand it. The only other thing I can think of is links to actual content such as 'require' which may not be secure but to check these you will have to look at the actual files - the content, not the link to the source is shown in the source code.

This is not a Zencart or WorldPay module problem per se. For more info try a search on Google.

Sorry I can't be more specific.

All the best,

Alan

Thanks very much for taking a look - it really is appreciated.

I did the same as you and couldn't find the issue either. I only noticed it when I was trying the site on IE7 before going live as I always use Firefox and have the warning turned off. It does actually do it for me even when I cancel a sale as well as place an order and it seems strange it doesn't do it for you - it must hate me!!

I will have a closer look when I get time but I really do appreciate you giving up your time to take a wee look - us Westies need to stick together!!

Many thanks.

Hamish

Hamish,

I had been viewing your site in IE6. I have now had a look in Firefox and IE7. No problem in Firefox but in IE7 I get the same "insecure items on page" message as you. I then had a look in my own sites - same thing.

This is not a Zencart or WorldPay module problem per se.

How wrong can I be! No change there then :-o

It is actually a WorldPay Module problem. This is my understanding of what the problem is. The Callback page is not actually displayed from the Zencart host server but from the WorldPay server. WorldPay somehow take the content of the Callback page from the merchant's site and display it from within their own site as witnessed by the URL of the callback page

https://select.worldpay.com/wcc/purchase

As currently configured the link to the Merchant's site is non-secure ie http://www.mysite.com/.... This is what is causing the "insecure items on page" message although why it should only be IE7 that is picking this up I have no idea.

The reason for this goes way back to when the OS Commerce WorldPay Module was originally ported across to ZenCart. OSC at that time were not too hot on security - the main reason I chose Zencart rather than OSC. No one (including me) has picked up on this legacy issue since.

The solution is pretty simple. Just two changes to make as follows:

1. Edit includes/modules/payment/worldpay.php

Find:

$callback_url = zen_href_link(FILENAME_WPCALLBACK, $zenId);
``` at around line 128.  Change this to:

$callback_url = zen_href_link(FILENAME_WPCALLBACK, $zenId, 'SSL');

Save the edited file to your server.

2. Login to your WorldPay account

Click 'Configuration Options' for your Select Junior installation.

Find the 'Callback URL' field and change the entry from:

http://<wpdisplay item="MC_callback">

to:

https://<wpdisplay item="MC_callback">

Click 'Save Changes'

That's it.  Pretty obvious really when you think about it!

Let me know if this works for you.

Regards,

Alan

Alan

Did not realise this problem might apply to me. I will ckeck it out on IE7 at home later.

My question is:

I do not have SSL on my site (at the moment - next thing to do after my upgade to 1.3.6). Will this solution work for me too even though I do no not have https?

Craig

Craig,

You should treat installing SSL on your site as a matter of priority. Although you do not collect credit card details via your website you do collect and store customer personal details and these are being transmitted across the internet insecurely. Ask your host if they have a shared SSL certificate you can use if you don't want to invest in a certificate of your own.

To answer your question I think you will find that you will get the same response from IE7 as Hamish and I have experienced. Making the change to your includes/modules/payment/worldpay.php file will not make any difference since the 'zen_href_link()' will only return an 'HTTPS://' URL if your configuration file has SSL enabled. Making the change now, while you remember, will make ready your WorldPay module for when you have SSL set up on your site. Of course you should only make the change to the 'Callback Url' in your WorldPay account configuration once SSL is enabled on your site.

Hope this helps.

Regards,

Alan

Thanks Alan

I shall make SSL a priority and make the changes you suggest then.

Thanks for your time on this.

Craig

My apologies everyone. There is an omission in my post #85 above. There is one further change required to the includes/modules/payment/worldpay.php file.

At line 129 change this:

$worldpay_callback = explode('http://', $callback_url);

to this:

$worldpay_callback = explode('https://', $callback_url);

If you don't include this change the callback will fail.

Sorry about any confusion caused by this. If anyone knows of a way for me to edit my original post to prevent further confusion could they let me know.

Craig (and anyone else who has not got SSL set up yet),

You should NOT make any of these changes until you have SSL set up on your site.

Regards,

Alan

Thanks again Alan.

Thought I would let you know that I've got SSL set up now :)
piece of cake really.

Although I find it strange the admin side is not 'secure' once you have logged in but I understand that will be in a future release.

I shall make the changes you suggest above.

Craig

Another update:

Made the changes you suggest to the WorldPay module and everything works OK. Have not checked whether I get the 'problem' in IE7, shall check that later at home.

Craig

Craig,

I've just put through a (cancelled) order on your site using IE7 and didn't get a "non secure items on page" message so it appears to be working OK. What I did notice is that the Shopping Cart icon at the top left does not act as a link in IE7 but does in IE6 which is strange!

Regarding SSL in Admin you are quite right it doesn't work out of the box as yet. Not all of the pages in admin need to be accessed securely e.g. the catalogue pages do not hold confidential information, however the customer pages do and should be accessed securely. I'm afraid it's a screwdriver job to fix this at present. There may be posts elsewhere on the forums detailing how to do this but here is a flavour of what needs to be done.

Edit admin/includes/boxes/customers_dhtml.php

Change:

  $za_heading = array('text' => BOX_HEADING_CUSTOMERS, 'link' => zen_href_link(FILENAME_ALT_NAV, '', 'NONSSL'));
  $za_contents[] = array('text' => BOX_CUSTOMERS_CUSTOMERS, 'link' => zen_href_link(FILENAME_CUSTOMERS, '', 'NONSSL'));
  $za_contents[] = array('text' => BOX_CUSTOMERS_ORDERS, 'link' => zen_href_link(FILENAME_ORDERS, '', 'NONSSL'));
  $za_contents[] = array('text' => BOX_CUSTOMERS_GROUP_PRICING, 'link' => zen_href_link(FILENAME_GROUP_PRICING, '', 'NONSSL'));
  $za_contents[] = array('text' => BOX_CUSTOMERS_PAYPAL, 'link' => zen_href_link(FILENAME_PAYPAL, '', 'NONSSL'));

to:

  $za_heading = array('text' => BOX_HEADING_CUSTOMERS, 'link' => zen_href_link(FILENAME_ALT_NAV, '', 'SSL'));
  $za_contents[] = array('text' => BOX_CUSTOMERS_CUSTOMERS, 'link' => zen_href_link(FILENAME_CUSTOMERS, '', 'SSL'));
  $za_contents[] = array('text' => BOX_CUSTOMERS_ORDERS, 'link' => zen_href_link(FILENAME_ORDERS, '', 'SSL'));
  $za_contents[] = array('text' => BOX_CUSTOMERS_GROUP_PRICING, 'link' => zen_href_link(FILENAME_GROUP_PRICING, '', 'SSL'));
  $za_contents[] = array('text' => BOX_CUSTOMERS_PAYPAL, 'link' => zen_href_link(FILENAME_PAYPAL, '', 'SSL'));

This isn't the whole deal. You need to find ALL of the files that link to admin pages that display confidential information and change 'NONSSL' to 'SSL' in the link code to those pages.

Regards,

Alan

Hi Alan,

I have implemented your solution and everything is working great now. Thanks very much indeed for the time you have given to resolve the issue and my apologies for not getting back sooner.

Kindest regards,

Hamish

Hamish,

Naebother big man.

Alan

Hi Alan

Sorry in the delay replying.

Thanks for all your effort, even checking out my site. Above and beyond the call of duty.

I have noticed the IE7 problem too. Works in FF which I use most of the time and in IE6 which I check at work (Win 2000). I have to check the site at home in IE7. The 'link' is there, just aligned well to the right. I am using an adaption of the 'simple zen' template so I will probably have to post a question in that forum.

Question: Do you alter all those admin links to SSL? If I knew an update was going to address the issue soon I would probably wait. As you suggested I will check the forums if there is a definitive list.

Thanks once again

Craig

Craig,

The short answer is I have changed some but not all. High on my todo list. I have encountered a bit of a bug 'though. I use a shared SSL certificate and things are configured such that I have one set of files but two paths ie
http://www.mywebsite.com
and
https://secure.securedomain.com/www.mywebsite.com
This works absolutely fine except with some of the SSL links in Admin the first time of clicking I get kicked out to the login screen. If I then log back in the problem dissappears! Others have reported similar problems elsewhere but I haven't seen any definitive solution. As far as I can ascertain this only seems to happen where a shared SSL certificate is used. Just recently I have been able to consistently reproduce this behaviour and now have a solution - but I don't know why it works. I'm still on v 1.3.5. When I upgrade to 1.3.6 I'm going to do some more rigorous testing. If I achieve consistant results I'll post the solution somewhere.

According to the Development Roadmap posted here:
http://www.zen-cart.com/forum/showthread.php?t=36912
an overhaul of the Admin is not due until 1.6 which may be some time off.

I've not tried this but a possible way to secure the whole of the admin would be set the non-secure path in the admin configuration to the secure path ie in admin/includes/configure.php:

  // Main webserver: eg, http://localhost - should not be empty for productive servers
  define('HTTP_SERVER', 'https://www.mywebsite.com');
  // Secure webserver: eg, https://localhost - should not be empty for productive servers
  define('HTTPS_SERVER', 'https://www.mywebsite.com'); // eg, https://localhost 

This is probably a bit of overkill and I would test this on a test site first to ensure there are no unexpected side effects and/or server performance issues.

Regards,

Alan

It's nice to know I'm not the only one with a to do list!!

Cracked the alignment problem I had with IE7, just upgraded to the latest version of the template :-)

Although I'm no coder/programmer, let me know if you need help testing anything Alan, all your work is appreciated.

Craig

help!! this doesn't work on 1.3.6 - for some reason I still get TEST transaction text page even when its live! Obviously missed the 1.3x but not 1.3.6 part!! new shop - so cannot roll back :)

any ideas on why or how to resolve it!!

Think your answer is earlier on in this thread:

http://www.zen-cart.com/forum/showpost.php?p=253886&postcount=63

Hopefully just a simple fix.

:-)

Craig

CES:

Think your answer is earlier on in this thread:

http://www.zen-cart.com/forum/showpost.php?p=253886&postcount=63

Hopefully just a simple fix.

:-)

Craig

you angel :):) I thought that I had got as much from this thread that I needed - obviously missed that part!!!

Thank you I will try to remember this in future - oh buy the way

I have older version on exact same server using worldpay module - and I don't get this issue - so I think its for some reason zen cart code? rather than configuration?

thanks
Sarah