Ceon Manual/Offline Card Payment Module v1.0.0!

Hi,

It gives me great pleasure to release the first version of our Manual/Offline Card payment module for Zen Cart!

This Payment Module provides everything a Zen Cart shop owner needs to accept Credit/Debit Card payments over the internet for inputting into a Manual/Offline Card Processing System.

Full details about the contribution are available at its website:

Information and Downloads - http://dev.ceon.net/web/zen-cart/ceon_manual_card

I recommend that you take a look at the above site but for those who want more information first (lazy you :) ), here is the feature list:

Features

This Payment Module has been written to be as comprehensive as possible (despite the limited nature of a payment module for Manual Card Processing). The current feature list follows.

Support for many Card Types

Each card type can be enabled or disabled at the click of a button inside the admin. Cards currently supported:

• Visa
• Mastercard
• Switch/UK Maestro
• Visa Delta
• Solo
• American Express
• Visa Electron - UKE
• Diners Club International
• JCB

Please Note: If you would like additional card types added, please just ask us. It's not difficult for us to add more (mostly we need need to know details like “Are Start Dates required/optional/not used?” etc.).

Allows gathering of the following information:

      o Card Holder's Name
      o Card Type
      o Card Number
      o Expiry Date
      o CVV Code
      o Start Date (Switch/UK Maestro/Solo/American Express Only)
      o Issue Number (Switch/UK Maestro/Solo Only)

Please Note: The CVV code and middle digits of the credit/debit card number are sent in an e-mail to the store owner. This means that the full details don't need to be stored on the server and is by far the most secure way to collect Card Details for manual/offline processing. The rest of the details can be accessed at all times through the "Orders" section of the Admin.

Retains entered Card Details right throughout the checkout process.

If a user goes back to change their Shipping Address, or realises at the Confirmation Stage of the checkout procedure that they have entered some incorrect information, when they return to the Payment Page the card details they entered previously will be automatically restored. This prevents any frustration with customers having to re-type details and should help prevent customers leaving at the last hurdle! Please note: If your server has PEAR:Crypt_Blowfish installed, this information is kept encrypted in the session so as to protect the confidentiality of the details!

Visual Validation Feedback using JavascriptVisual Feedback of Javascript Validation.

In order to catch any problems with Card Details entered by the customer as quickly and easily as possible, this module will not only alert the user to any incorrect information when they attempt to submit the form, it will actually highlight the form fields which require their attention. Again this should help to reduce customers getting frustrated and leaving at the last hurdle!

Icons for each Credit Card accepted.

If you enable the option in the admin, icons are displayed for each credit/debit card accepted (see picture at right). Maybe not an essential feature, but it does look more professional for your shop!

Ability to disable Autocomplete.

Some browsers store credit/debit card numbers and/or CVV numbers entered and automatically insert them in a card number field/CVV field when a user returns to a website. This can be quite disconcerting to customers so the option to have this browser feature disabled is offered (and set by default) by the Ceon Manual Card payment module.

Dynamic Start Date and Issue Number support.

Certain cards (Switch/Maestro/Solo/American Express) may need a Start Date to be supplied for authorisation to take place, while certain cards (Switch/Maestro/Solo) also may need an Issue Date to be supplied. This module dynamically displays the necessary form gadgets to capture this information from the user based on the cards types enabled in the admin.

Debug Support.

Sometimes there can be problems with a shop's server settings. The debug mode allows you to see what information was to be sent and the server setup (encryption settings) identified so you can check your settings. Most people should never need this though and it is subsequently disabled by default.

Complete support for Zen Cart 1.3.x's Observer/Notification System.

There are two versions of this module, one of which makes full use of Zen Cart 1.3.x's handy new notification system to make installation even more of a breeze!

Enjoy! :thumbsup:

Please read the documentation before posting any questions in this thread so that we can hopefully keep the number of posts here down to a minimum!

Download NOW!

If you like this contribution and get a lot of use out of it, please consider making a donation!

All the best...

Conor
ceon

Hi,

Forgot to post a screenshot of the Javascript Validation Visual Feedback, so here it is... (also, it's "Maestro" and not "UK Maestro", there isn't any difference anymore! :) )

If you like/use this module please let us know (or even better, donate! :P )

All the best...

Conor
ceon

conor:

.......

Please Note: The CVV code and middle digits of the credit/debit card number are sent in an e-mail to the store owner. This means that the full details don't need to be stored on the server and is by far the most secure way to collect Card Details for manual/offline processing. The rest of the details can be accessed at all times through the "Orders" section of the Admin.....

Hi Conor,

Just a thought. If you have the Email Archiving mod installed will these emails then be archived in your database therefore leaving a security hole?

Regards

Brent

Brent:

Hi Conor,

Just a thought. If you have the Email Archiving mod installed will these emails then be archived in your database therefore leaving a security hole?

Regards

Brent

If it does, then surely that also applies to the existing ZC cc module?

Hi Brent,

I love your questions sometimes... you really think about things from a strong security perspective... as a result they really benefit everyone!

I'm happy to say that this module sends the e-mails as "cc_middle_digs" so Zen Cart doesn't archive them. The e-mail sent to the e-mail address as specified in the module's configuration is the ONLY way to get the middle digits and the CVV number.

It also has a message at the bottom of it (in capitals!) which reminds the user to delete the e-mail once they've charged the card.

Tried to make this one 100% secure from the start, but it's great to have someone asking important questions as a backup! :cool:

All the best...

Conor
ceon

Hi Conor,

Thanks for making this available :smile:

Just installed to test and getting a 'cannot redeclare' conflict with your Protx mod (Protx mod installed but not turned on in admin):

Fatal error: Cannot redeclare file_exists_in_include_path() 

(previously declared in /[path to file]/admin/includes/functions/extra_functions/ceon_manual_card_functions_file_system.php:28)

in /[path to file]/includes/functions/extra_functions/protx_direct_functions_file_system.php on line 27

Cancel that report - for anyone reading who has the same error, the solution is to upgrade to v 2.04 of the Protx mod which includes a check to see if that function has already been declared previously by this mod :smile:

Hi Pixxi,

Glad you like the module!

I was going to say you must have an older version of our protx_direct module but you beat me to it, thanks! :thumbsup:

I introduced the check for the existence of that particular function in version 2.0.3 of the protx_direct module so anyone with that version need not upgrade to 2.0.4 if they don't want to (as not much has changed between those two versions)... upgrading won't do any harm of course though! :)

All the best...

Conor
ceon

to accept Credit/Debit Card payments over the internet for inputting into a Manual/Offline Card Processing System.
Allows gathering of the following information:

o Card Holder's Name
o Card Type
o Card Number
o Expiry Date
o CVV Code
o Start Date (Switch/UK Maestro/Solo/American Express Only)
o Issue Number (Switch/UK Maestro/Solo Only)

Please Note: The CVV code and middle digits of the credit/debit card number are sent in an e-mail to the store owner. This means that the full details don't need to be stored on the server and is by far the most secure way to collect Card Details for manual/offline processing. The rest of the details can be accessed at all times through the "Orders" section of the Admin.

Okay, let's get this straight. In most cases collecting information online and then running it through an EPOS terminal in an offfline 'bricks and mortar' shop will put the shop owner in violation of the agreement they have entered into with Mastercard/Visa. You can end up with a visit to your shop, your EPOS terminal ripped out and be blacklisted for life from using thir services again.

Secondly, under current UK legislation and under Mastercard/Visa T's and C's you are not allowed to store credit card information in an online environment unless:

1. The card details are stored on a separate server, used only for that purpose, and which can only be accessed by the ip address of the store collecting the information.
2. The company storing the data will have to submit to an annual security audit, carried out by trained industry professionals experienced in security audits (the cost will run into 000's of pounds a year.

This is why, in the UK at least, the use of Credit Card modules on websites, to collect card data for manual processing, is a thing of the past.

In the case of a complaint from a customer about a fraudulent transaction on their card from a website collecting and storing card details the hosting company can end up with that whole server being seized.

Vger

That is quite a bold statement - can you supply references to the relevant documentation to back it up?

Below is a snippet, and a link to a full article which goes into some depth to explain this. What's not in the article is the requirement to keep credit card data on a separate server - but this is how it is being applied in practice:

Payment Card Industry Data Security Standard
Build and Maintain a Secure NetworkRequirement
1: Install and maintain a firewall configuration to protect data Requirement
2: Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data Requirement
3: Protect stored dataRequirement
4: Encrypt transmission of cardholder data and sensitive information across public networksMaintain a Vulnerability Management Program Requirement
5: Use and regularly update anti-virus softwareRequirement
6: Develop and maintain secure systems and applicationsImplement Strong Access Control Measures Requirement
7: Restrict access to data by business need-to-knowRequirement
8: Assign a unique ID to each person with computer accessRequirement
9: Restrict physical access to cardholder dataRegularly Monitor and Test NetworksRequirement
10: Track and monitor all access to network resources and cardholder dataRequirement
11: Regularly test security systems and processes.Maintain an Information Security PolicyRequirement
12: Maintain a policy that addresses information

The devil is in the detail, some of which is listed in the full article:

http://64.233.183.104/search?q=cache:caGbxvYs0acJ:usa.visa.com/download/business/accepting_visa/ops_risk_management/cisp_PCI_Data_Security_Standard.pdf+visa+storing+credit+card+details+online+security+audit&hl=en&gl=uk&ct=clnk&cd=1

And this quote from Protx:

Recently Visa, MasterCard and other major card schemes have introduced security audits to ensure that all merchants who collect credit card data comply with strict guidelines surrounding the collection and storage of credit card data.

VSP Direct merchants collect credit card data on their own website and will be asked by their bank to undergo an audit to ensure that data is kept secure at all times.

Alternatively, if you do not wish to undergo such an audit, then you can outsource the collection of credit card data to Protx, by using VSP Form or VSP Server.

Vger

Thank you for that as I'm just about to explain this to a customer. :thumbsup:

Hi,

What Vger says is true and is something we reinforce in our Protx Direct payment module's documentation, however, as with all policies in life, it's up to yourselves to judge what to do about compliance.

As is mentioned in the documentation for this module, we take no responsibility for anyone's usage of the module.

What I will say here though is that at no point are the customer's card **full ** details stored in your database by this module. Obviously a SSL certificate to secure your checkout is recommended as essential by us but again it is up to the individual shop owner to take responsibility for their decisions as to how they accept card details.

All the best...

Conor
ceon

Hi,

Just wanted to check if the CEON module works with v1.3.6. I can see no reason why it shouldn't, but always better safe than sorry :smile:

imac:

Hi,

Just wanted to check if the CEON module works with v1.3.6. I can see no reason why it shouldn't, but always better safe than sorry :smile:

We are using conners module with our carts running 1.3.6 We have not found any problems with it.

Another great module from the ceon team : :cool:

AndrewClarke:

We are using conners module with our carts running 1.3.6 We have not found any problems with it.

Another great module from the ceon team : :cool: Good to know. Many thanks. :thumbsup:

Hi,

kelvyn:

I can set it to any date in the future and the error is the same! Could it be something to do with the date reversal thing?

I'm sorry to say that any problems encountered are due to a malfunctioning site and not the payment module itself... hopefully I can help kelvyn with his site privately.

All the best...

Conor

I have a customer in Germany trying to pay using his Maestro card:

With my shopping cart filled up with fine items there's no chance for me to
get the items paid. I do not own any Credit Card and the system always says,
that the number of my Maestro Card is invalid

I am using 1.3.2 with the CEON module. I get dozens of orders per day, but this person's card is not accepted - it would be great to be able to turn off the number checking anyway as we process the cards using a separate online system.

Hi,

I need more information than that to help you.

What is the exact error?

When does it occur? (At the javascript stage?, after?)

palm:

I am using 1.3.2 with the CEON module. I get dozens of orders per day, but this person's card is not accepted - it would be great to be able to turn off the number checking anyway as we process the cards using a separate online system.

The numbers aren't checked with this module... it's too unreliable to use BIN codes, hence the "Card Type" selection gadget being used now.

The only checking of the number is that it's longer than 10 numbers and the standard Zen Cart code.

Feel free to e-mail me about this at the address on the website. Please also let me know what version of the module you are using.

It's highly likely however that something's wrong with your customer's details but we'll see... :)

All the best...

Conor

palm:

I have a customer in Germany trying to pay using his Maestro card:

With my shopping cart filled up with fine items there's no chance for me to
get the items paid. I do not own any Credit Card and the system always says,
that the number of my Maestro Card is invalid

I am using 1.3.2 with the CEON module. I get dozens of orders per day, but this person's card is not accepted - it would be great to be able to turn off the number checking anyway as we process the cards using a separate online system.
My German customer tells me their Maestro card is issued by "Volksbank/Raiffeisenbank Rendsburg-Eckernfoerde" and the card number does not have the standard 16 digits. I wonder if this is the reason its failing to be recognised as a valid card number?