How secure is credit card info in eWay plugin

  • Posts: 33
  • Thank you received: 0
9 years 3 months ago #211702

-- HikaShop version -- : 2.5.0
-- Joomla version -- : 2.5.28
-- PHP version -- : 5.4.44
-- Browser(s) name and version -- : Chrome 44.0.2403.155 m

We are using the eWay plugin for event bookings. I have attached an image of our checkout page which seeks credit card info as part of this payment method. It is not an SSL page as we understand that the information is not actually received or stored on our server but is received directly at the eWay server.

We'd like to confirm this and also to know the best way to describe the security of this process to our customers - some of whom are suspicious to apparently providing credit card info on a form on a non SSL page.

Attachments:

Please Log in or Create an account to join the conversation.

  • Posts: 82867
  • Thank you received: 13374
  • MODERATOR
9 years 3 months ago #211704

Hi,

HikaShop has two eWay plugins. The normal eWay and the eWay Rapid payment plugins.
The eWay payment plugin displays a credit card form on your website checkout so that the customer can enter his information and that is then sent to your server which sends it to eWay for processing.
So with that payment plugin, the credit card information goes through your server (even if not stored) and you should have a SSL certificate on your website in that case as it is normally mandatory (it can work without it, but that means that the credit card information is sent in clear between the browser of the customer and the website and you don't want that as hackers on the same network as your customers could intercept that data).

On the contrary, the eWay Rapid payment plugin redirects the customer to the eWay payment page (which has a SSL certificate already) and the customers can then enter their credit card there which will be sent directly to eWay for processing. Security-wise, that's the best solution as the credit card data doesn't go through your server, and you don't need a SSL certificate in that case.

Please Log in or Create an account to join the conversation.

  • Posts: 33
  • Thank you received: 0
9 years 3 months ago #211753

Mmm... so obvious question, which one are we using? I selected the only eWay payment plugin showing in the payment plugin list titled "HikaShop eWAY payment plugin" thinking it was the Rapide version you described. I don't see any other eWay plugin in the list. We have the Business version.

Last edit: 9 years 3 months ago by austega.

Please Log in or Create an account to join the conversation.

  • Posts: 82867
  • Thank you received: 13374
  • MODERATOR
9 years 3 months ago #211758

You're using the normal eWay plugin, not the Rapid one. The Rapid one was developed by eWay themselves.
I guess that if you ask them for it, they would provide it. Otherwise, here is a copy of it from when they sent it to us:

File Attachment:

File Name: eWAY_rapid.zip
File Size:14 KB

Attachments:
Last edit: 9 years 3 months ago by Jerome.

Please Log in or Create an account to join the conversation.

  • Posts: 33
  • Thank you received: 0
9 years 3 months ago #211775

Thanks. I just install it using Joomla Extension Mgr? And its compatible with both J2.5.28 and J3.4?

Please Log in or Create an account to join the conversation.

  • Posts: 26158
  • Thank you received: 4028
  • MODERATOR
9 years 3 months ago #211779

Hi,

The XML is not compatible with Joomla 3 but the code seems to be ok.
So for an install on J3 ; it will requires some modifications in the XML file (or a new XML file).

Regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.

Please Log in or Create an account to join the conversation.

  • Posts: 33
  • Thank you received: 0
9 years 3 months ago #212090

Hi Jerome/Nicholas,

I tried installing it on our J2.5.28 site using the normal Extension Manager and received an error message as per the attached image.




Can you suggest how we should proceed?

David

Attachments:

Please Log in or Create an account to join the conversation.

  • Posts: 33
  • Thank you received: 0
9 years 3 months ago #212093

Just had a chat session with eWay customer support (attached).

File Attachment:

File Name: eWaySuppor...cord.txt
File Size:5 KB



They understand that the responsibility for packaging the eWay Rapid 3.1 plugin with its Responsive Share Page features to suit your cart and the current Joomla versions is in your court. I hope you agree because we need this plugin (and were under the impression it was part of the Hikashop Business package that we procured).

Thanks for looking at this for us.

Attachments:

Please Log in or Create an account to join the conversation.

  • Posts: 26158
  • Thank you received: 4028
  • MODERATOR
9 years 3 months ago #212094

Hi,

Open the XML file in the ZIP and remove the line

<folder>language</folder>

If you want to migrate the plugin to be compatible with J3 you have to replace the tags "<install" and "</install>" by "<extension" and "</extension>".

eWay rapid is not an official HikaShop plugin ; and that plugin is not provided by HikaShop packages.
As you can see in the XML file, the plugin was developed by "Nick Texidor", he is the author and he has the copyright for the plugin.
Nicolas has just attached a version that we received ; we never tested it, we do not have any documentation or test account.
So we can provide some generic help ; As you can see, the current issues are not related to HikaShop but to plugin packaging to feet to Joomla specifications. But if there are other issues afterwards, it will become difficult for us.

Regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.

Please Log in or Create an account to join the conversation.

  • Posts: 33
  • Thank you received: 0
9 years 3 months ago #212148

Thanks Jerome.

I extracted the zip file locally, removed the language line and then rezipped it. I installed this new eWay.zip file on the J2.5.28 site and received a slightly different error message, about not finding the eWayrapid.php file in the tmp directory (see attached).



I looked at the Control Panel File Manager and agree the looked for file(s) is not there.

Can you suggest something else I have missed / need to do? I may have missed something you think is obvious.

Attachments:

Please Log in or Create an account to join the conversation.

  • Posts: 26158
  • Thank you received: 4028
  • MODERATOR
9 years 3 months ago #212155

Hi,

I don't know how you have modified the XML and the ZIP.
I applied the modification in the plugin and perform a test install on J3 ; it worked fine.

You can find the plugin with the XML modification in the Nicolas message (I updated the zip)
www.hikashop.com/forum/payment-methods/8...y-plugin.html#211758

Regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.

Please Log in or Create an account to join the conversation.

  • Posts: 33
  • Thank you received: 0
9 years 3 months ago #212192

Thanks Jerome.

Install on J3 Dev site. Install went fine, without error messages. However when I go to configure the plugin I see some warning/error messages - I have uploaded a screen shot with these highlighted.

Install on J2.5.28 Live site. I edited your ewayrapid_j15.xml file to change the coded version number from 1.5 to 2.5 and then renamed this file ewayrapid.xml, rezipped the collection using PeaZip, and this installed without error messages. The plugin configuration screen opened without any warnings/error messages etc.

In both versionss I note that the plugin configuration asks for username and password whereas the standard eWay plugin provided by Hikashop asks for eWay customer id. I live chatted with eWay customer service and they advised this was for an API key and password which i have since established and used. However testing this on the J2.5.28 live site returned a blank page when selecting this payment method at Hikashop checkout. The URL bar shows www.sag.org.au/hikashop-menu-for-categor...out/step/step-2.html but no content displays and viewing the page source returns nothing. (In case it is relevant I restricted access to this payment method to a user group so that I could hide it from our normal customers.)

Can you help me get over these two current hurdles?

I also spoke to eWay about whether they would offer and maintain an eWay Rapid payment plugin for Hikashop and my chat partner said he would pass on the request to their dev team but said it would depend on the number of Hikashop users who were interested in eWay (which I could not provide). Hopefully they will contact you about this, or alternately you might want to contact them.

From my client's viewpoint we want a reliable eWay payment method that captures credit card info on the eWay server rather than our site and I think we were given to understand that Hikashop Business offered this before we committed to it. If eWay do not take up the project, could you provide and maintain the Rapid plugin including in a J3 compatible form?

Attachments:
Last edit: 9 years 3 months ago by austega.

Please Log in or Create an account to join the conversation.

  • Posts: 82867
  • Thank you received: 13374
  • MODERATOR
9 years 3 months ago #212222

Hi,

Here is a new version of the plugin which will fix the warning messages on the backend and install fine on both version of Joomla :

File Attachment:

File Name: ewayrapid.zip
File Size:13 KB


Install it on your website and you won't get them anymore.

Now regarding the blank page issue during the checkout, please turn on the error reporting and debug mode settings of your Joomla configuration and try again.
You should hopefully get an error message displayed instead of a totally blank page which will help us understand the issue.

Remember that this plugin wasn't developed by our team, so we're discovering the issues like you. Normally, that plugin should work, and looking at the code, it's not bad, but since we can't test it on our end as we don't have any test account, we of course cannot guarantee that it will work reliably and can't fix the minor issues that were found by ourselves (so far, mainly due to the use of a recent version of PHP and Joomla for which the plugin wasn't developed for).

I've sent an email to our eWay contact to request a test account so that we can check the plugin on our end.

Attachments:

Please Log in or Create an account to join the conversation.

  • Posts: 33
  • Thank you received: 0
9 years 3 months ago #212249

Thank you, Nicolas. We appreciate your stepping in.

This is the error reported on the J2.5.28 live site with maximum reporting, after installing your new ewayrapid plugin and selecting it as payment method in the Hikashop checkout:
"Fatal error: Cannot redeclare class EwayPayment in [...]/public_html/plugins/hikashoppayment/ewayrapid/eWAY/RapidAPI.php on line 496"

Also uninstalled old and installed new plugin on J3.4 dev site (without problems) and received the same error with a test transaction:
"Fatal error: Cannot redeclare class EwayPayment in [...]/public_html/j3/plugins/hikashoppayment/ewayrapid/eWAY/RapidAPI.php on line 496"

Note on J3.4 site still receiving some error warnings on plugin configuration screen:
"Strict Standards: Only variables should be assigned by reference in [...]/public_html/j3/plugins/hikashoppayment/ewayrapid/ewayrapid.php on line 441

Strict Standards: Only variables should be assigned by reference in [...]/public_html/j3/plugins/hikashoppayment/ewayrapid/ewayrapid.php on line 448"

Last edit: 9 years 3 months ago by austega.

Please Log in or Create an account to join the conversation.

  • Posts: 26158
  • Thank you received: 4028
  • MODERATOR
9 years 3 months ago #212250

Hi,

There is conflict between "eWay" and "eWay Rapid" ; you should unpublish the "eWay" one.

Regards,

Jerome - Obsidev.com
HikaMarket & HikaSerial developer / HikaShop core dev team.

Also helping the HikaShop support team when having some time or couldn't sleep.
By the way, do not send me private message, use the "contact us" form instead.

Please Log in or Create an account to join the conversation.

  • Posts: 33
  • Thank you received: 0
9 years 3 months ago #212385

Sorry for the delayed response. Other parts of life intruded.

I unpublished the eWay plugin on the dev j3.4 site, cleared the site cache and tested a transaction. The eWay payment option did not appear but choosing the eWay rapid payment option and clicking next still produces:

"Fatal error: Cannot redeclare class EwayPayment in /home/sagorg/public_html/j3/plugins/hikashoppayment/ewayrapid/eWAY/RapidAPI.php on line 496 "

Do I need to uninstall the eWay plugin rather than just unpublish it? Or is it some other problem?

I can send you login credentials to the dev site if this helps.

Please Log in or Create an account to join the conversation.

  • Posts: 13201
  • Thank you received: 2322
9 years 3 months ago #212393

Hi,

Unpublishing the plugin should have solved your issue, but you can still try to uninstall it.

I checked in the code and this class is indeed declared only in two places, the eway plugin and the ewayrapid one.
So disabling or uninstalling one of the plugins must solve that issue.

Please Log in or Create an account to join the conversation.

  • Posts: 33
  • Thank you received: 0
9 years 2 months ago #212469

Well I uninstalled the eWay plugin on our Dev J3.4 site, cleared the cache and reran an eway rapid test transaction and certainly proceeded further than before - I have attached three images showing the error page that was returned.

Can I send you login credentials to this Dev site so you can investigate further? If so how do I do this securely?

David

Attachments:
Last edit: 9 years 2 months ago by austega.

Please Log in or Create an account to join the conversation.

  • Posts: 13201
  • Thank you received: 2322
9 years 2 months ago #212472

Hi,

You can send the login credentials via our contact form, so a backend and a ftp access are required.
Please give the url of that topic in the message.
www.hikashop.com/support/contact-us.html

Please Log in or Create an account to join the conversation.

  • Posts: 33
  • Thank you received: 0
9 years 2 months ago #212566

Done and thanks for looking at this.

When looking at this, remember we have both Hikashop and Virtuemart on this site. Virtuemart is used for physical shop stuff and Hikashop is used solely for event bookings (with JEvents).

David

Please Log in or Create an account to join the conversation.

Time to create page: 0.125 seconds
Powered by Kunena Forum