Missing credit card numbers..

[andymin]

Every now and again we get an order through but no credit card number. It is happening seemingly random but maybe 1 in every 12 orders. Instead of all the card numbers, start/end date etc it just says: 'Payment Method: Credit Card' All the other data is captured ok.

 

I have the cc_cvv+uk_switch v1_31 installed. My guess a problem with the validation, new cards with higher number ranges?

 

Anyone experiencing similiar problems? (these are a couple of posts about this from a while back but no replies)

 

Also we do a manual charge on the PDQ machine in the store.

 

Any help would be appreciated.

 

regards

 

Andrew

[eba]

I got the same problem since we changed the server. I moved everything to a new server running FreeBSD 5.1, The latest MySQM 4.0 and the latest apache 1.3 + the latest php. Since we are getting the problem you mentioned. I don't think it ever happened before.

 

The weird thing is that I didn't changed the configuration, except for some paths of course.

[eba]

I think I found out what caused the missing credit card number.

 

I copied a catalog from an old server using an enterprise version of RedHat. They didn't have problems. When I reinstalled this old cart on a server running FreeBSD 5.1 with the latest versions on MySQL 4.0, Apache 1.3.29+modssl ... we got orders without credit card numbers.

 

I tried to upgrade the cart. We got some trouble with the database structure but that's another story. But we still got the problem! I tried at home with konqueror and Modzilla and everything worked; My colleague tried at his home with M$ Internet Exploder 6and it didn't work except when he used the test number 4111 111... I asked him to try on another computer so he tried on his daughter's computer with Netscape and IE 6. It worked in both cases but the IE version was a slightly different release. So he tried upgrading his IE then it worked with some cc numbers but not with others. He installed Netscape on his own computer and that worked! I disabled ssl and that worked also with his IE.

 

The problem was obviously M$ IE 6 and ssl. But then why did it work on the old server? I tried updating the openssl port from version 0.9.7a to 0.9.7c and then I recompiled Apache+modssl with the new libs. That seems to woks. We are still testing but till now we didn't have any problems since the change.

 

Emmanuel

[apha]

I've noticed similar issues to this and all seem to be IE related more than anything else. I also did some testing with the CC numbers and using the dash between numbers. What I noticed, in most cases at the confirm screen, it would display the credit card number as 4111XXXXXXXX1111 and would go through fine. If it displayed payment type and just said credit card, then it would go through but nothing would show. I want to say, in all cases that I used the dash between numbers, I had no problem. Not sure if that helps or not, but something seems to fail at the point the number is entered and confirmed with IE.

[Guest]

We are also experiencing this problem, the store has been running perfectly for over a year and this began to happen, slowly at first, but it seems to be increasing in frequency ? it happened to four orders over the weekend alone. No changes have been made anywhere in the store recently, no server upgrades, no obvious reasons at all. The customers have reported no problems at check-out and say they where able to go through to completion with no problems. Since this is a live store, this is causing a great problem; the customers that have to be contacted for their information are very angry and often cancel the order.

 

Unfortunately, I am not even able to replicate the error, so have no starting point to begin my search for a cause. Could you post how you where able to replicate?

[apha]

Ok, I've tested some more. The problem appears to be more and more IE related than anything else. I created four dummy accounts on the test store. I then started placing orders by loging in and out for each of them. I first used Netscape and did not see any problems. The version of Netscape I have is 7.1 to be percise. All orders went through and would display at the confirmation screen the credit card used with 'XXXXXXXX' for some of the numbers. I pretty much decided that I could place orders all day long with Netscape and would not see any problems.

 

So I ran more tests with IE 6.0 and all of the updates and patches that I could find or need. Pretty much the store runs into problems with IE. If you go through and place an order and get to the last confirm screen. This screen should show you all the information and the payment type as credit card, the CC number and CC expiration for the order. The problem at this point the screen might only say method Credit Card. If you click yes then the order goes through and the customer thinks all is fine. If you stop here and back up and try again, you might get an error saying the first 4 digits (mine showed nothing) and you would need to back up again. The last option is it would go through fine and show like it does in Netscape and all would be fine.

 

So clearly the problem seems to be in IE for some reason. We can not expect the customers to keep backing up and going forward till they see the correct information display. I can not very well tell around 85 to 90% of the visitors using Internet Explorer to download Netscape and all will be fine. It would be nice if someone that knows the fix to this could respond back. In the meantime, I'll keep looking around and seeing what I can come up with. I also noticed some issues with logging in to the account as well. I know for a fact I had the login and password correct and had to repeat a few times to finally log on. I did not seem to have this issue with Netscape.

 

Best of luck,

[mrguytx]

This is likely due to the IE "security updates" that Microsoft has been sending out via it's Windows Update service.

 

This could be really bad news if it indeed breaks the credit card module.

 

I can only imagine how many THOUSANDS of people have their computers set to automatically update, and thus will be automatically BREAKING our shopping carts.

 

I hope the developers here can fix this issue, even though it's NOT their fault.

 

=mrguytx

[Iron Eagle]

I am seeing the same problems. People are complaining that they cant log in and then the credit card info is missing all of my orders today are bad!!!!

 

I will have to abandon Oscommerce soon if this is not sorted out PLEASE someone look into this. We have tried everything and nothing helps.

[apha]

Ok, I came across this once before and remember doing this once on a server. I had to hunt around and was not sure if this was the same fix or would work. I decided to give it a try and added this to the httpd.conf file and then restarted the httpd service.

 

Work around fix...

 

# global ssl setup

<IfModule mod_ssl.c>

SSLSessionCache dbm:/var/log/httpd/ssl_scache

SSLSessionCacheTimeout 300

SSLMutex file:/var/log/httpd/ssl_mutex

SSLRandomSeed startup file:/dev/urandom 512

SSLRandomSeed connect builtin

 

## HERE IS WHAT I ADDED (goes on a single line)

SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

## END OF CHANGE

 

</IfModule>

 

I've gone in now with IE and do not see the problems that I had before. So this appears to be a decent work around and does not break anything else. I hope this helps out and please post here if you find anything else and if it works or causes problems.

 

Best of luck,

[Guest]

We are on a shared server, so will not be able to change the httpd.conf. Is there a way to get the same results on a hosted server?

[Guest]

Sorry, neglected to ask if this could be implemented through .htaccess perhaps?

[defender39]

OMG. Someone just pointed me to this thread. How many of you are MS1 vs MS2

 

I am MS1 heavily modded and so I cant upgrade fully to MS2 at this time.

 

I have been seeing the same problems and have clients using OSC too and they are really getting unhappy. Ever since we have installed Scart too ask customers why they didnt buy we have seen an amazing amount of lost revenue becuase of customers not being able to either create account...or checkout.

 

So I have decided to really start trying to fix it but first I needed to recreate the problems (as so many of you have tried). I asked in a popular forums I participate in to sign up test accounts with IE and try to recreate the problem and also report to me their configuration.

 

Almost immediately someone had the problem and they reported they had the google toolbar in IE with the popup blocker ON. Turns out...this is problem #1. As soon as the popup blocker is disabled he can create an account.

 

So how is this fixed? Well it turns out that MS2 doesnt report errors the same way and has a 2 step create account process vs the 3 pages for MS1. So I actually changed my MS1 create account to the 2 page MS2 create account successfully and so far most reports are good. I do also think that there is an SSL problem somehow and that the handshake breaks with IE as occassionally a customer says "page cannot be displayed" happens. I am not a shared SSL and this is my dedicated server. However the SSL is a comodo instant SSL chained cert.

 

I can post my changes for create_account which is pretty easy to implement and requires no SQL changes as a contrib. Anyone interested. I think eventually the entire checkout should be redone in the same fashion.

 

This is all just frustrating.

[apha]

I'm not sure if or how to work it in the .htaccess file. Since the server is mine, I felt the problem involved more than one site. So I did not see a problem with making the change to the httpd.conf file and it corrected the IE issues.

 

I'm using various versions from the earliest releases to the present. Most have been some moded/loaded versions and I've gone and tweaked some for my own needs. I've found the forums to be a huge help in most cases, but I have had to hunt high and low and learn a lot on my own. Its amazing how much needs to be tweaked just to get a little extra info here or there.

 

You might ask your hosting company what can be done in the area of an .htaccess file to help out or if they could see the need in editing the httpd.conf file.

 

Later,

[mrguytx]

has anyone notified the developers about this???????????????

 

I have a feeling we're about to experience a flood of bad shopping carts.

 

who should I notifiy?

[defender39]

I believe Harold has been officially notified today about this possible problem.

 

I hope we can find a solid resolution fast.

 

I still would like to hear from many of you if you are MS1 or MS2.

 

Also note that I have made the httpd.conf changes in hopes that it helps but I also plan an openssl upgrade asap but that wont be fun.

[mrguytx]

MS2.

 

But I haven't seen this problem yet as we aren't officially live yet.

 

I will do some testing today.

[Artist122]

I'm having problems with the CVV and Start Date v1 when we go to look up the order in the Admin there is no CVV number or start date, but we do get the credit card number and expiration. Does anyone know why this is and how to fix it?

[defender39]

was your store fine in the past or is this a new store with problems

 

have you installed a new contrib? are all the orders messed up or is this just a percentage?

 

are you MS1 or MS2

[Guest]

We are using MS2 as well, but whats odd is that another site we have is using an identical version, on an identical server and has never had this happen before.

[mrguytx]

That's because I think this is a CLIENT issue. So maybe no one with the new IE6 security patch has hit the other site yet.

[comeran]

I am using OSC2.2ms2 and I am having a problem with customers going through the checkout process, then clicking confirm and being sent back to the login page. They say there is no error, so they think it went through and leave.

 

I have an average of 500 unique visitors a day and have had about 2 people a week complain of this issue.

 

When I go to ANet there is no information on those clients so the card number was never transmitted to them.

 

Could this be the same problem?

 

Comeran-

[andymin]

I have upgraded the CVV contribution to cc_cvv+encryption v1_61. We had an order almost immediately with no credit card number.

 

For the record, the site concerned has an average of 800 uniques everyday and runs on 2.2ms2 but there are a number of mods. We have tried with the card validation turned on and off.

 

I did a test order on a friends machine (broadband) and for the first time had a page expired error during ordering, but this did not replicate the exact problem of submitting an order with no card details.

 

Currently around 10% of our orders are registered with no card details.

 

Sessions settings are:

 

Force Cookie Use - False

Check SSL Session ID - False

Check User Agent - False

Check IP Address - False

Prevent Spider Sessions - True

Recreate Session - False

 

I have checked and we do not appear to be getting the same error as in comeran's post, where users are sent to the login page.

 

We have some customer feedback and they have mentioned problems whilst ordering, no real conclusions other than they may be using the 'back' button at some point during the ordering process.

 

regards

 

Andrew

[Guest]

i've been trying to get the credit card numbers working on my test site for a few days. i'm having the problem where PAYMENT METHOD in the invoice says CREDIT CARD, but has no data. i have the middle #s set to be emailed through the admin section, which works, but i can't get the rest to come through--anywhere.

 

also, i noticed that there's no credit card type option while checking out. inputs for owner, number, and exp. date--that's all.

[AlanR]

also, i noticed that there's no credit card type option while checking out.  inputs for owner, number, and exp. date--that's all.

The system determines the type of card from the credit card number, the user does not need to tell the system the card type.

 

The stored digits of the cc number can be found in admin - orders. Click on the order in question, then edit.

[ccakes]

Interestingly enough - my MS2 will not take credit card numbers, it keeps asking for payment method. As well as this, if users try to add a new delivery address the form just repeats on itself and the information is not sent through to the Database. THIS ONLY HAPPENS ON IE6 with the latest security patch, Mozilla for example cruises through no problems. Unfortunately 80% of our probable customers are using IE6. So I think we need a fix fast.