Cybersource Hosted Order Page Support

Great work, I am experiencing an error on checkout but most of the functionality is here. Here's some feedback:

In the uc_cybersource_hop_form function on line 354 the HOP file is referenced inside a non-existant module, which causes a fatal error. You actually added a few lines to check that the file exists, which is nice, but the error check appears after the line requiring the file.

On that note, is the uc_cybersource directory actually the best place to put the HOP.php file, though? I can imagine someone upgrading ubercart and losing their HOP.php file. I'm not sure about the standard drupal way to handle this situation, but for a different module I put this kind of file below the root folder and added a configuration settings where you can specify the location of the required file.

Should the credit card module no longer be listed as a dependency of uc_cybersource any more? HOP doesn't actually use the credit card module so it's confusing to have all the credit card info showing up.

Perhaps we should add a few lines explaining how to generate the HOP.php file? I'm not sure where that documentations should go, but here's an explanation based on cybersource's documentation from http://www.cybersource.com/resources/quickstart/HOP/PHP_HOP_QRG.pdf

Log in to the CyberSource Business Center https://businesscenter.cybersource.com/ using your CyberSource merchant ID. Navigate to 'Settings' > Security Keys'. On this page, choose 'PHP' and click the Generate Script button. Place the HOP.php file in the ubercart/payment/uc_cybersource directory (or wherever we decide the HOP.php file should go).

It also might be helpful to include a script or something to rename the dd() and L() functions in HOP.php - that took me a little while to do correctly and I bet a lot of people will have trouble with that.

Hope that helps! I'll let you know if I find anything else.

sites/all/libraries is the increasingly common place to put stuff like HOP.php

I think instructions are better than a script for renaming dd and L - most users will be on environments where they can't run scripts, but "Find and replace..." works reasonably well.

We might be able to put in a hook_requirements that does a token_get_all on the HOP.php and looks for dd and l functions.

I'm all in favor of this patch. But before I commit it I'd like to hear from someone who currently uses the uc_cybersource module to make sure this patch doesn't break the existing functionality and to check that the upgrade path works.

The phone number is not being passed to cybersource. Though it's not required, I do think users would expect to see their phone number at this step if they entered it on a previous screen.

We could clear the cart when the payment confirmation is POSTed back by CyberSource, but that seems potentially confusing to the user because the cart could be cleared without any clear connection to the user's actions. Looking through the code, the PayPal WPS payment method does not clear the cart, so I followed that convention.

It looks like you changed this and do actually call uc_cart_complete_sale() which is great, but we need to update the form so that users actually see the description that tells them to set the Merchant POST url in cybersource account - that took me a while to figure out what was going on...

line 339: '#description' => t('The post url in your Cybersource account need to be set to http://yourdomain/cybersource/hop-post'),

Also, when this url is called an error is returned - is that why my orders aren't being completed after they're paid for, see: https://classifieds.harvardmagazine.com/cybersource/hop-post

On the checkout review page the Payment Method is set to "Paying By: Cybersource", which doesn't really make sense to someone expecting to pay for their purchases using a credit card...

I think we should just "review" to "credit card" in the function uc_cybersource_payment_method() so that users see "Paying By: Credit Card" because that's what they'll expect to see.

#13/14 is a major improvement, thanks, automatically redirecting to the appropriate page and using the site-wide completion message makes a lot of sense.

@jumpfightgo: Are you using just the new HOP functionality?

@ezra-g: In hook_requirements() can you check the $phase argument to differentiate between install and runtime invocations of hook_requirements()? Because the variable uc_cybersource_method will never be set during the initial install phase, install will always fail if HOP.php isn't present, even if the site owner intends to use the SOAP method. Maybe change hook_requirements() so that it returns a REQUIREMENT_INFO message about HOP.php during install instead of a REQUREMENT_ERROR, but retain the REQUIREMENT_ERROR for the runtime condition? Likewise, in hook_requirements(), the error message says "For instructions on how to generate this file, please refer to your CyberSource Documentation" - can this be made into a link so users won't have to go fumbling around searching for the info?

I would still prefer to see a review of this patch from someone who is using the non-HOP version of uc_cybersource, just to make sure it doesn't inadvertently break the existing functionality, but I'm not going to hold up committing the patch because of that.

@TR - yes we're just using the HOP functionality.

Unfortunately Cybersource documentation is either in PDF or iframed HTML, so direct links are challenging. How about the following:

For instructions on how to generate this file, please refer to Cybersource's Hosted Order Pages Documentation, specifically the "Downloading Security Scripts" in chapter 2 of the HOP User's Guide.

Yes, that message looks great. I just don't want to leave the user dangling with no idea where to look or what to do.

Should the credit card module no longer be listed as a dependency of uc_cybersource any more? HOP doesn't actually use the credit card module so it's confusing to have all the credit card info showing up.

I think this issue still needs to be resolved. We're using this patch on a live site now. Today I went in to check a configuration setting and clicked on "payment gateways" under "store administration" > "Configuration" > "Payment settings". The "cybersource settings" on that page are for using cybersource silent post or soap, but NOT for HOP. That was very confusing, and I imagine will be even more confusing and frustrating to new users.

Just curious if there is any update on the progress with this. We are looking into a few options and required to use Cybersource, so this patch would be a big help to us.

Thanks,
-Mitchell

@juncmodule: Did you test the patch? Does it work? "Progress" on an issue only happens via community participation to review the proposed changes and help address any concerns raised. No one has done that since ezra-g posted the latest patch two months ago.

I would love for us to be able to add this to a subequent Ubercart release.

I downloaded Ubercart 6.x-2.x-dev and have applied patch 809972-d.patch above and with some minor changes got things working. I was able to checkout by using the Cybersource HOP in my browser. So far so good.

My notes to get it working:

Immediately I got an error that function uc_cybersource_hop_include() was not found, so I needed to add this line to the top of uc_cybersource.install:

require_once("uc_cybersource.module");

I also had to do the following:

edit uc_cybersource.module and replace getPublicKey() with getSharedSecret(). See http://www.ubercart.org/contrib/139

And of course I had generated and edited a Cybersource HOP.php file.

1) Log into Cybersource and go to Tools & Settings > Hosted Order Page > Security
2) Generate and save PHP security script HOP.php
3) Edit it and replace instances of L( with csL( by hand.
4) Copy it to modules/ubercart/payment/uc_cybersource

I think nobody who uses the cybersource regular gateway is going to review this. They just won't even look for it.

My suggestion is to commit it somewhere early in a 6.x-2.x-dev and then try to get some attention for testing that out (i.e. via twitter) prior to the next release.

Patch 809972-d for cybersource is still has a dependency upon the Credit Card module.
If I turn off CC, I get this msg when I hit /admin/store/settings/payment/edit/gateways.

Fatal error: Call to undefined function uc_credit_encryption_key() in modules/ubercart/payment/uc_cybersource/uc_cybersource.module on line 67

I see reference to a few other uc_credit_xxx functions in uc_cybersource.module, so it appears to be still dependent.

So far so good...
undefined function uc_cybersource_hop_include()
...added require_once("uc_cybersource.module"); to the top of .install as instructed -- No Problem

Cannot redeclare l() ...made the changes listed above -- No Problem

Will be testing this in the next couple days! Thanks for getting this going.

I'm getting this error when I go from checkout to review (/cart/checkout/review)
Call to undefined function getpublickey() in /home/uanative/public_html/sites/all/modules/ubercart/payment/uc_cybersource/uc_cybersource.module on line 457

oops sorry... trying to keep it all straight... missed the comment about this above :-)

I put in http://www.[domain].com/cart/checkout/complete
... in the Merchant POST URL field in Cybersource --> Not sure what this is doing
... and in the Custom Receipt URL --> This seems to pass back some needed info to me.

I'm not sure if this is a cybersource test environment problem or ubercart or what, but my balance is coming back without being paid (so in UC store interface, the balance is basically the unpaid total from their cart).
Where am I going awry ? Thanks as always !

John, Can you try logging into Cybersource (probably the "Test Business Center") and doing a transaction search? All transactions and attempts should be listed, so see if yours are there.

I have my own issue where failed transactions are not returned to my test server. I use the HOP for another e-commerce site (not running Ubercart), so I may have the cybersource decline response URL set wrong. I'm actually not sure where it should go or perhaps it should not be set.
I'd appreciate any advise anyone has regarding that.

Thanks so much. Yes the transactions are showing up in CS. AND... I simply didn't understand what pending meant in the realm of cc processing (ie, the payment went through but the money won't be delivered to the bank until midnight). So... I just need to key off of the change to pending status and set up the proper triggers. Almost there. Thanks all!

When I used another e-commerce system with CyberSource, there were transactions that did not push through fully which is a possible outcome. So I had to change parameters that were sent to the CS hop. I'm guessing in your case maybe the transaction is similar to when your credit card is approved to pump gas, but the final amount is not known until you are done.

What are your Cybersource HOP settings in Ubercart?
I have "Authorize and capture" selected and I'm using the "Test Center".

The 809972-d.patch worked as expected in my testing. Let's roll this into the uc_cybersource code!

Thanks for all your hard work Ezra. Committed.

I've enabled shipping and taxes.
When I submit the payment below to Cybersource HOP, it sends the subtotal of $5.00.
Is this a configuration or a coding issue?

Calculate shipping cost
Standard shipping: $5.95
Payment method
Subtotal: $5.00
Standard shipping: $5.95
Subtotal excluding taxes: $10.95
Massachusetts sales tax: $0.31
Total: $11.26
Paying by: Credit/Debit card payment processed by CyberSource

Hi there-
So I'm trying to applythe patch uc_cs_hop.diff, but its failing. It says:
Hunk #@ FAILED at 77.
1 out of 2 hunks FAILED -- saving rejects to file uc_cybersource.install.rej
patching file uc_cybersource.module

Is there a reason this is failing? I really need to use a HOP so that I'm PCI compliant and need to get this to work.

Thanks in advance.

@sfonte: Use Ubercart 6.x-2.x-dev, the patch is already in there. Or use 6.x-2.4, and the patch should apply cleanly.

OK so I had to install the -dev version for it to work. I was using 6.x-2.4, and was getting the error.

Now it seems to work, but I just want to verify that ic3.com is a CyberSource url? It just seems odd.

Thanks in advance for your help- its really appreciated.

Has anyone been able to apply this patch to the production release 6.x-2.4?