Emailing CVV rather than storing with CVV2 Version 2.1

[Malvarlin]

I have altered my copy of the mod to add the CVV code to the bottom of the extra info email that gets sent out rather than storing it in the database, am i right in assuming that I can do the latter part by altering the following line

 

'cc_cvv2' => (isset($HTTP_POST_VARS['cc_cvv2']) ? $HTTP_POST_VARS['cc_cvv2'] : ''),

to

'cc_cvv2' => '',

in /includes/classes/order.php

 

also

 

in cc.php if I add this

 

$message = $HTTP_POST_VARS['cc_cvv2'] . "\n\n";

tep_mail('', MODULE_PAYMENT_CC_EMAIL, 'Extra Order Info: #' . $insert_id, $message, STORE_OWNER, STORE_OWNER_EMAIL_ADDRESS);

 

after this

 

$message = 'Order #' . $insert_id . "\n\n" . 'Middle: ' . $this->cc_middle . "\n\n" . $HTTP_POST_VARS['cc_cvv2'] . "\n\n";

tep_mail('', MODULE_PAYMENT_CC_EMAIL, 'Extra Order Info: #' . $insert_id, $message, STORE_OWNER, STORE_OWNER_EMAIL_ADDRESS);

 

will it go in yet another seperate email altogether.

 

 

Thanks

[germ]

I could be wrong, but off the top I'd say emailing it isn't PCI compliant just as much as storing it in the DB is.

 

Email is even less secure (in my opinion) than putting it in your DB.

 

And if I'm wrong it won't be the first or last time that's been true...

:blush:

[FIMBLE]

And if I'm wrong it won't be the first or last time that's been true...

 

i dont some how think you are unless its encrypted of course