Credit Card Expires

We have set up our store for a client and all seems to be working quite well! However, the emails generated after a purchase that send purchase and credit card info to the client do not include the cc expiration date, and he needs this to process the order. It does show up in the Admin section under "Customer Orders", but we have not given our client permission to access the Admin area. Is there a way to get this info included in the emails sent to him? Thanks much for your help!

What payment module are you using?

sorry 'bout that... We are using the Credit Card-Offline Processing (cc) module.

You could run into major problems with PCI compliance by emailing all of the CC information.

Why are you not letting the client into his admin?

As recommended by Zen Cart -- and to hopefully be pci compliant -- there are two emails that get sent -- each going to different email addresses and each one having only a portion of the cc number. All we would like is for the expiration date to show up in one of those emails. As far as allowing the client access, we could find no way of limiting access to a specific area -- like Customer Orders -- as was possible when we used MIVA. And I really don't want others to have full access to other Admin areas 'cause I don't want to run the risk of having someone else screw things up and then have to re-do them.

There's a mod here that allows you to restrict access to some admin areas:

http://www.zen-cart.com/index.php?main_page=product_contrib_info&products_id=86

I haven't used it, so I don't know how the restrictions work.

kabbinfever:

As far as allowing the client access, we could find no way of limiting access to a specific area -- like Customer OrdersYou could try the Admin Profiles addon, as mentioned by stevesh above.

kabbinfever:

And I really don't want others to have full access to other Admin areas 'cause I don't want to run the risk of having someone else screw things up and then have to re-do them.
Sounds like you should really be educating your users, rather than handcuffing them.

So may I assume that there is no way -- other than adding a mod -- to accomplish what I am wanting to do?

No, it can be done, with some PHP fiddling.

It's just that you're sending all the credit card information via insecure email that way.

No, in my 11:03 post, I said that two (2) emails were sent (that's the way Zen Cart has it configured) to two different addresses at his business. One email has 8 of the 16 numbers -- the "outside" numbers -- and the other has the other 8 -- the "inside" numbers. Only by putting the two emails together can the full card number be known. The expiration date of the card shows up in the Admin - Customers - Orders area -- along with the partial card number, but does not show up in either email. Is that not how it is supposed to work? Perhaps I am the one who is confused...

No, you're right, but if it were up to me, that 'extra' email with the center digits wouldn't be possible. You should have to access the Admin to get those.

As it is, the only info someone would need is the expiration date to use that credit card (not everybody requires CVV). That's why I'd be hesitant to do what you're proposing.

I buy a lot of stuff online, and I don't know who your client is. I might stumble across his/her website and want to buy something, and the idea of all my essential CC info being transferred in the clear via email makes my knees all wobbly.

The real answer to your situation is for the client to get serious about this ecommerce thing and get a proper credit card merchant account.

I agree with you. I'm not particularly enamored of the double email thing either -- it's just the way that Zen Cart had it configured, so that's the way we let it be since that was the way the client wanted to do things. After all I have read about cc crime and the PCI DSS stuff though, I would like to make things as secure as I can... The way we have it now is probably not the way to go. If you can tell me how to get only one email to be sent, I'd be more than happy to do that and then load the Admin Profiles module and give him access to the rest of the info that way. Thanks.

The better, and far more secure, way is to use a Credit Card gateway whereby the CC is processed in real time, while the customer is still involved in the process. This has the added benefit of ensuring that the customer actually entered the numbers correctly, since the submission is validated by their own bank when the payment is processed. This way numbers are never stored on your webserver, and the money is immediately sent to your bank for deposit. You'll also only get completed orders whose payments have been authorized, saving you from having to manually process each payment and have to deal with bad cards and insufficient funds etc before processing.
It's way more secure that way, and makes you much less likely to be liable for any CC security matters, since you never have to handle the CC number directly.

If you need a competitively-priced gateway service provider, click on the "Partners" link at the top of this page, and choose the payment providers section. Choosing one of those providers also helps support the Zen Cart project at no extra cost to you, in fact even saves you money in the process.

We've done gateway providers before and can direct our client to that option... but can you tell me how to delete or keep the one email with the "outside" cc numbers from being sent so that he only receives the one email (with the "inside" numbers) and has to go to the Admin area to get the rest? Where in Zen Cart is the control for that?

You're talking about the Order Confirmation - you can disable the copy being sent in the Admin> Configuration> Email Settings.

Much thanks for all your help and suggestions. We're making the necessary changes and -- although it may take a while to install and configure the "Admin Profiles" module -- I now feel much better about the security issue. Thanks again!

I was looking for the answer to this question:

kabbinfever:

We've done gateway providers before and can direct our client to that option... but can you tell me how to delete or keep the one email with the "outside" cc numbers from being sent so that he only receives the one email (with the "inside" numbers) and has to go to the Admin area to get the rest? Where in Zen Cart is the control for that?

It seems no one really answered. If someone could really just explain, briefly, the line of code involved in getting the middle digits, and the file that pulls that information, I think I can construct a similar line to pull the expiration info.

Our order processor does not need admin login rights, so the way we have things setup is that she gets the order and extra cc info emails to process and ship the orders. It is our decision to keep it working that way. But, we need to include the cc expiration date in the extra cc email as well, otherwise someone will have to login to retrieve that information.

Can someone point out to me what makes this information pull into an email? I can find the defines files just fine. But, that doesn't show me how the extra email gets pulled together.

Your help and suggestions are appreciated!

greenraingraphics:

I was looking for the answer to this question:

It seems no one really answered. If someone could really just explain, briefly, the line of code involved in getting the middle digits, and the file that pulls that information, I think I can construct a similar line to pull the expiration info.

Our order processor does not need admin login rights, so the way we have things setup is that she gets the order and extra cc info emails to process and ship the orders. It is our decision to keep it working that way. But, we need to include the cc expiration date in the extra cc email as well, otherwise someone will have to login to retrieve that information.

Can someone point out to me what makes this information pull into an email? I can find the defines files just fine. But, that doesn't show me how the extra email gets pulled together.

Your help and suggestions are appreciated!
I did want to mention that I found another related post:
https://www.zen-cart.com/forum/showthread.php?t=97783

I understand the danger of what I am asking, and that you will not post a solution to this question on this forum.

So - if it's safe to send middle digits in an email, along with an email for order confirmation, can there be a third email that sends the expiration date information? This would give admins the opition of sending that info to yet another email address for security reasons, if they chose to do so. Otherwise, the information could be sent to the same email, just yet another bit of information to put together with the rest.

Just wondering if there's a difference in adding a third email, since in our case we receive both current emails to the same address anyways.

thanks!

greenraingraphics:

Just wondering if there's a difference in adding a third email, since in our case we receive both current emails to the same address anyways.
No, there's no difference. If you're already sending both to the same address, you basically have zero security or protection anyway. That's not how the module is supposed to be used, for security reasons.

Even if I knew a way to hack this for you, I wouldn't reveal it... I could potentially be party to assisting in the design of a process that enables fraudulent use of c-card details!

Perhaps the reticence of some of ZC's most noted gurus on this thread suggests they feel the same...