Credit card information unavailable at review order stage.

I am getting the same error and it seems necessary for WPP (?) when I have it disabled and use WPP I get errors that cvv was missing.

I'm using DEV versions (updating daily as they come available) and still having the CVV (and other credit card fields) not moving form checkout to review to merchant processes.

Sorry I do not know how to do GIT patches....

in uc_credit.module -> function uc_credit_uc_order($op, $order, $arg2) (line 313)

Adding the following code under line 373:

            if (isset($order->payment_details['cc_cvv'])) {
              $cc_data['cc_cvv'] = $order->payment_details['cc_cvv'];
            }
            if (isset($order->payment_details['cc_owner'])) {
              $cc_data['cc_owner'] = $order->payment_details['cc_owner'];
            }
            if (isset($order->payment_details['cc_bank'])) {
              $cc_data['cc_bank'] = $order->payment_details['cc_bank'];
            }

This will write missing (possibly 3) pieces of information to cache...

After doing this on the reveiw page, I do in fact see the Owner and CVV (I did not check with Bank but assume it will work now too).

Now to figure out why when I submit to the PayPal WPP sandbox it issues:

•Notice: Undefined index: AVSCODE in uc_paypal_wpp_charge() (line 447 of /home/content/21/7420121/html/sites/all/modules/ubercart/payment/uc_paypal/uc_paypal.module).
•Notice: Undefined index: CVV2MATCH in uc_paypal_wpp_charge() (line 449 of /home/content/21/7420121/html/sites/all/modules/ubercart/payment/uc_paypal/uc_paypal.module).
•We were unable to process your credit card payment. Please verify your details and try again. If the problem persists, contact us to complete your order.
•Notice: Undefined index: do_complete in uc_credit_cart_review_post_form_submit() (line 1322 of /home/content/21/7420121/html/sites/all/modules/ubercart/payment/uc_credit/uc_credit....

Those are PayPal issues not related (I don't think) to this issue.. but I'll try to track it down.

Edit...

Going through the code and debugging it for the paypal module, the problem does seem to be in the credit module...

in the Order passed to the paypal module I see the following:

[payment_details] => Array
        (
            [cc_number] => 8335
            [cc_exp_month] => 6
            [cc_exp_year] => 2015
            [cc_type] => Mastercard
            [cc_cvv] => 123
            [cc_owner] => Some User
        )

SO the problem is cc_number is being sent as only last four digits to paypal wpp function throwing errors from paypal.

Looking in the uc_credit.module, there is already a function called uc_credit_display_number() that handles the truncated last 4 digit display, so there is no reason for code that exists in function uc_credit_cron() : 'cc_number' => substr($data['cc_data']['cc_number'], -4), and function uc_credit_uc_order() : under case: save -> 'cc_number' => substr($order->payment_details['cc_number'], -4), since the forms that output the credit card to the user already are using the function for it. What this was doing is saving only the last 4 digits of the credit card to the Order object, and when passed to gateways (in my case, paypal) it fails since its not a valid credit card number any longer.

By replacing 'cc_number' => substr($data['cc_data']['cc_number'], -4) with just 'cc_number' => $data['cc_data']['cc_number'] in both cases worked for me. on Review page I see: Card Number: ------------8502 and CVV : --- which is what is expected. and now finally when I click submit order I get a successful completion! yey!

(2) Did you make changes to:

Line 237 (in function uc_credit_cron())

'cc_number' => substr($data['cc_data']['cc_number'], -4),
to
'cc_number' => $data['cc_data']['cc_number'],

Line 368 (in function uc_credit_uc_order())

'cc_number' => substr($order->payment_details['cc_number'], -4),
to
'cc_number' => $order->payment_details['cc_number'],

(as for seeing CC# or CVV, I see it when I am logged in as an administrator only.. if i am logged in as a authenticated user, I see only the mask for CCNumber and CVV).

The error you reported Notice: Undefined index: cc_type in uc_paypal_wpp_charge() (line 349 is happening because the order object was being stored with the last-4 cc#... function uc_paypal_wpp_charge() in uc_paypal.module loads the order object on line 287, and if you look at the cc_number its only the last 4 digits (unless you make the changes I described above)... I was getting the same errors with PayPal WPP. Since it seems you are not passing the credit card type (which would be stored in the order object as well), uc_paypal_wpp_charge() calls a function to figure out what credit card type based on the first number of the credit card (3 for amex, 4 for visa, 5 for mastercard)... since its not being passed the CC_Number in full it didn't recognize what credit card type it was.

The code if (substr($cc_data['cc_number'], 0, strlen(t('(Last4)'))) == t('(Last4)')) { is looking to see if the string "Last4" was stored in the credit card number (assuming that it will be the truncated version), the pull the full out of cache... (which it shouldn't be stored as Last4: ####) it should be stored as a full credit card number, and the function to display it on the form should do the truncating.

One other change I needed to make to uc_paypal.pages.inc (function uc_paypal_ipn()) starting at line 42, the //Assign posted variables to local variables

// Assign posted variables to local variables
  if (isset($_POST['payment_status'])) {
    $payment_status = check_plain($_POST['payment_status']);
  }
  if (isset($_POST['mc_gross'])) {
    $payment_amount = check_plain($_POST['mc_gross']);
  }
  if (isset($_POST['mc_currency'])) {
    $payment_currency = check_plain($_POST['mc_currency']);
  }
  if (isset($_POST['mc_fee'])) {
    $payment_fee = check_plain($_POST['mc_fee']);
  }
  if (isset($_POST['business'])) {
    $receiver_email = check_plain($_POST['business']);
  }
  if ($receiver_email == '' && isset($_POST['receiver_email'])) {
    $receiver_email = check_plain($_POST['receiver_email']);
  }
  if (isset($_POST['txn_id'])) {
    $txn_id = check_plain($_POST['txn_id']);
  }
  if (isset($_POST['txn_type'])) {
    $txn_type = check_plain($_POST['txn_type']);
  }
  if (isset($_POST['payer_email'])) {
    $payer_email = check_plain($_POST['payer_email']);
  }

I put them all in if isset statements since I was getting errors that mc_fee didn't exist... the IPN returned back from PayPal didn't contain 'mc_fee' so it was throwing errors..

With those changes above I was able to finally get through my checkout to paypal WPP and back successfully...

PS this was done against the LATEST dev version as of 6/22/2011.

Question: did you create a 'key' directory?

read: http://www.ubercart.org/docs/user/2731/credit_card_settings

You need to have a directory to store a encryption key.. ubercart writes a file there which is then called by line 936 as you posted above.

Credit card data security

Security is extremely important for websites handling customer credit card data. You should be as careful as possible in the way you protect the data to prevent credit card fraud. Please be sure you are selecting the right options, as some choices may decrease the security of credit card data on your website and should be avoided if at all possible. Most payment gateways will require compliance with a set of security standards called the PCI DSS. When the Ubercart credit card module is used in conjunction with an SSL certificate and Drupal's Secure Pages module, your site will conform to these standards.

First, you must configure the encryption settings for card data during checkout. To do this, you'll need to fill in the filepath textfield. Here you should specify a folder that is outside of your document root (i.e. not in your www or public_html directory) where the module can create a key file to encrypt credit card data. You will need to grant permissions on the folder that allow Drupal to write to it, but you can change this once the encryption file has been created. Relative paths will be resolved relative to the Drupal installation directory, so if you have a directory structure like the following:

mysite
mysite/www <-- Drupal installed here.
mysite/keys

You would be able to specify ../keys and Drupal will make sure the credit card encryption key is created in the proper directory. For security reasons, you should not use your site's files directory except in testing.

Note: If you are updating from a version where encryption was not required, be sure to click the link on the warning message that shows up to encrypt your existing credit card data. Once you do this, you won't be able to do it again. If you accidentally browse away from the page before encrypting existing data, just browse to /admin/store/settings/payment/cc_encrypt to see the form again.

As of Ubercart 1.0 RC 5, there is also a credit card debug mode that you can use when testing or to store encrypted card data with orders for offline processing. This may open you up to vulnerabilities, but you should be aware that even in debug mode Ubercart will truncate credit card numbers to the last 4 digits when a card gets processed. This is in accordance with the PCI DSS restriction that full card numbers and expiration dates should not be stored locally after a card has been authorized/charged. If you must use debug mode for offline processing, you should either manually wipe the numbers or use the "Debug mode data clearing" options on this form to make sure credit card data is not stored any longer than necessary. You may need to consult your terms of service with your payment processor to make sure this method is even possible according to your contract.

Finally, credit card masking by default applies to all users of the site, but it is possible in your user access control settings for you to designate roles that can view whole CC numbers when they're stored.

I hope this helps!

I am using the latest version of the DEV branch as of June 22 (there may be a new one today I haven't checked yet hehehe)... I was seeing the AVSCODE error and CVV2MATCH error until I made the changes to the credit module I listed above.. then things worked fine as it was getting the 'full' credit card number and could get the credit card type from that (btw: I don't think you need to have credit card type on your checkout form.. you can disable that... paypal wpp function will call a function that checks the first digit of the credit card number and figure out it from there.. (3 = amex, 4 = visa, 5 = mastercard)... so I disabled mine (why make the user fill in one more field than necessary on an already long check out on my clients site where they have to fill out like 15 options or more at any given time).

Once I made teh change to the credit module (using the latest dev version) the error I got was that mc_fee didn't exist, so the code I put above for the uc_paypal.pages.inc fixed that problem... now the only problem I still have (which is reported in another thread) is event though the IPN comes in and is validated by ubercart, the status always stays as 'pending'.

My suggestion would be to download the latest DEV version (not the beta), carefully make the edits I listed above... and test again. I hope that will fix your issue... I know how frustrating it can be as I was ripping my hair out, and what hair I missed, my client found and ripped out :D

Sorry if this seems like a stupid question but.. do you have CVV enabled on your payment->credit card options? It is required by PayPal WPP...

There REALLY NEEDS to be some built in logic/checking in the Credit Card/PayPal module that if you enable PayPal WPP then the admin should force you to enable CVV (since its not stated on the admin screen that its needed for PayPal WWP). Make sure you have CVV enabled so it gets stored in the 'Order' object and the function for paypal wpp can access it and pass it on to paypal.

I added an issue/feature reqest at #1198414: Adjust Credit Module/PayPal To Force Certain Options When Selected

Now I am more confused as the code you posted earlier was for uc_paypal_wpp (with the AVSCODE and CVV2MATCH error messages in #11 above).. thats the PayPal Website Pro function in the paypal module.

I have only been using/testing the PayPal Website Payment Pro since thats the only method my client wants on their site. I have not tried with other gateways.

This is my first time trying to create a patch.. it was run against the 6/23/2007 DEV branch..

(TR or longwave, if i did this wrong please let me know... )

@gmopinillosv: You need to move the backup out of the sites/all/modules directory to like a /backup/ubercart directory.. Drupal will auto-scan the sites/all/modules directory and try to find modules there.

Edit

Make that the 6/23/2011 branch.. I lost 4 years somewhere!

But wouldn't the credit card need to be stored in the cache (attached to the Order Object) so on the next page it can be accessed via the gateway? I think this was overwriting the cached copy of the data with a truncated last-4 digit and when the next page requested it, it no longer had the full cc_number. I would think it would be the job of the procedure used after gateway response (passed or failed) that should clear out the data?

longwave, you are the man!

I applied it to the latest dev version (today, 6/30/2011) and it worked perfectly! Woo Hoo! Thanks!