Hi,

I kept getting "CardNumber length invalid" messages and Invalid Transactions with my payment gateway, SagePay, but only when the client manually built an order. Investigating further, I printed the $order object where it was being used to build the form in the form function and saw that $order->payment_details['cc_number'] only contained the last four digits.

So I decided to decrypt and check $order->data['cc_data'], the encrypted card data, using:

      // Initialize the encryption key and class.
      $key = uc_credit_encryption_key();
      $crypt = new uc_encryption_class;

      // Save the unencrypted CC details for the duration of this request.
      $cc_cache = unserialize($crypt->decrypt($key, $order->data['cc_data']));
      print_r($cc_cache);

And sure enough, again, just the last four digits.

Clearly the card data is not sticking around in a full enough form to be able to process a transaction later, after it has been applied to an order.

Comments

greg.harvey’s picture

Title: The credit card terminal tries to sent only the last four digits of the card number to payment gateways (Process card form) » Credit card entry option on the order edit form in store admin is misleading and cannot work - remove
Priority: Critical » Normal

This turned out to be confusion caused by the UI. You can enter (and my client was entering) card data on the preceding screen, edit order, but if you do that then UC cannot save the card data and be PCI DSS compliant, as I understand it. So it doesn't.

Which begs the question, why is that there at all? It's misleading and confusing. IMHO it should be removed.

greg.harvey’s picture

Status: Active » Needs review
StatusFileSize
new667 bytes

Ok, patch attached which leaves this option in for debug mode only, since any other time it won't work anyway.

rszrama’s picture

Simple enough fix for a long standing usability problem. Will test this on both 1.x and 2.x and get back to you. Thanks, Greg!

greg.harvey’s picture

Cool - thanks to longwave too, for helping out on this one.

rszrama’s picture

Status: Needs review » Fixed

Ok, committed this to 6.x and 5.x with a minor modification - added a message on where to find the credit card terminal form.

rszrama’s picture

For those who care, here are the patches. Virtually identical.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.