Closed (fixed)
Project:
Ubercart
Version:
5.x-1.8
Component:
Code
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
6 Oct 2009 at 10:00 UTC
Updated:
3 Nov 2009 at 19:10 UTC
Jump to comment: Most recent file
Hi,
I kept getting "CardNumber length invalid" messages and Invalid Transactions with my payment gateway, SagePay, but only when the client manually built an order. Investigating further, I printed the $order object where it was being used to build the form in the form function and saw that $order->payment_details['cc_number'] only contained the last four digits.
So I decided to decrypt and check $order->data['cc_data'], the encrypted card data, using:
// Initialize the encryption key and class.
$key = uc_credit_encryption_key();
$crypt = new uc_encryption_class;
// Save the unencrypted CC details for the duration of this request.
$cc_cache = unserialize($crypt->decrypt($key, $order->data['cc_data']));
print_r($cc_cache);
And sure enough, again, just the last four digits.
Clearly the card data is not sticking around in a full enough form to be able to process a transaction later, after it has been applied to an order.
| Comment | File | Size | Author |
|---|---|---|---|
| #6 | uc_credit_order_edit_details_5.patch | 819 bytes | rszrama |
| #6 | uc_credit_order_edit_details_6.patch | 819 bytes | rszrama |
| #2 | 597022-uc_remove_card_form.patch | 667 bytes | greg.harvey |
Comments
Comment #1
greg.harveyThis turned out to be confusion caused by the UI. You can enter (and my client was entering) card data on the preceding screen, edit order, but if you do that then UC cannot save the card data and be PCI DSS compliant, as I understand it. So it doesn't.
Which begs the question, why is that there at all? It's misleading and confusing. IMHO it should be removed.
Comment #2
greg.harveyOk, patch attached which leaves this option in for debug mode only, since any other time it won't work anyway.
Comment #3
rszrama commentedSimple enough fix for a long standing usability problem. Will test this on both 1.x and 2.x and get back to you. Thanks, Greg!
Comment #4
greg.harveyCool - thanks to longwave too, for helping out on this one.
Comment #5
rszrama commentedOk, committed this to 6.x and 5.x with a minor modification - added a message on where to find the credit card terminal form.
Comment #6
rszrama commentedFor those who care, here are the patches. Virtually identical.