The issue is that once the CC information is validated it is not checked again, leading to unnecessary failed payment messages for the user. The use case is a customer is at checkout and fills out the entire form including CC info, except they do not enter a phone number and it is required. Since the CC info is correct, it will pass validation. But the phone number will force the form to reload and ask for the missing phone number.

After the form reloads, for users without the permission to view CC details, the CC number is truncated to say "(Last 4) 1234" and the CVV is hidden and replaced with "---". The customer adds the missing phone number and doesn't realize they need to re-enter the CC number and CVV code. They click Review Order and there is no second CC info validation check so the truncated info is passed on to the Review Checkout page. The customer clicks Submit Order and the bad CC info is sent to the payment processor where it is rejected, sending the customer back to Checkout to correct the CC info.

I know past versions of Ubercart would not allow this. There would be a second validation on the truncated CC info and they would not make it to Review Checkout without fixing the info. This seems to be a new bug in 6.x-2.x-dev.

Just to be clear, CC validation is working correctly on the first check. But once it passes validation, it is never checked again even though the numbers are truncated and no longer should validate.

I'm reviewing the code now and comparing it to past versions to see what changed.

Anybody know what code needs to be fixed to make sure CC validation happens on a reloaded form?

Thanks for your time and for sharing such awesome ecommerce software.

Comments

tr’s picture

What payment module are you using?

matthand’s picture

Credit Card with Virtual Merchant

So the payment module is the culprit?

Thanks for the reply.

longwave’s picture

Status: Active » Postponed (maintainer needs more info)

The user should not need to enter the CC number and CVV again. These are never displayed back in full to the user for security reasons, but they are cached server side and if the truncated versions are sent back, they are replaced with the original values.

If you cannot reproduce this with Test Gateway then this is perhaps a bug in your credit card gateway module.

tr’s picture

Status: Postponed (maintainer needs more info) » Closed (cannot reproduce)

Feel free to reopen if you can provide more information or can reproduce this with a core Ubercart payment method/gateway.