E-fraud tools compatibility (CVD, AVS, etc.)

This is also a critical issue for us on various sites where we use Commerce Moneris. We may need to move back to PayPal if this isn't resolved, as the risk of fraud is too great.

Hi,

I do not have access to moneris system anymore.
If you provide a patch, I can make you a maintainer of this module and you can deploy the patch.

I've added a warning to the module's description until this issue can be resolved.

This is my first crack at an update for this. I realize that other work is going on with the module to make it more compatible with commerce, but we needed a solution right away. I've tried a few purchases in the Moneris testing environment, which come back with the proper AVS/CVD codes, but I haven't tried this yet in a production environment.

There are some other things I've included, in particular with the AVS data that might be specific to our website. I haven't coded anything in the commerce module, so please let me know.

A few notes I had upon quick inspection of the patch:

function commerce_moneris_transaction($payment_method, $order, $charge, $values) {
+  global $user;
   $transaction                 = commerce_payment_transaction_new('commerce_moneris', $order->order_id)
;

Instead of using the global user variable, we should use the uid associated with the order. It looks like this is specifically for grabbing the email address, but it wouldn't work for anonymous users. I believe the email address should be available somewhere right in the order data.

+  // Get Billing info
+  $billing_info = commerce_customer_profile_load($order->commerce_customer_billing['und'][0]['profile_id']);

Instead of pulling field data out of the order with a hardcoded language (or no language), we should create an entity metadata wrapper for the order and pull values out of it instead. This way, we don't have to worry about the field's language.

For example, the PayPal WPP module does it like so:

$billing_address = $order_wrapper->commerce_customer_billing->commerce_customer_address->value();
'FIRSTNAME' => substr($billing_address['first_name'], 0, 25),

-      WATCHDOG_ERROR
+      WATCHDOG_ERRORhttps://developers.linkedin.com/documents/linkedin-apis-terms-use

I think this was pasted in here by mistake?

+/**
+ * Get a country format friendly with Moneris.
+ * TODO: What's a better way?
+ */
+function commerce_moneris_get_full_country($country_code) {

We can use country_get_list() to get the name for any country. If the display names for the US and Canada are different than what Moneris is expecting, we'll probably have to keep them hard-coded as "Canada" and "United States", but at least with country_get_list() we can account for other countries.

+/**
+ * Separate street number from street address.
+ * TODO: Is there a better way?
+ */
+function commerce_moneris_separate_address($address) {
+  $address_output = array();
+  $address_explode = explode(' ', $address);
+  foreach ($address_explode as $add_frag) {
+    // if it starts with a number
+    if (preg_match('/^\d/', $add_frag) === 1) {
+      $address_num = $add_frag;
+      break;
+    }
+  }
+  $address_output[0] = $address_num;
+  $address_output[1] = trim(str_replace($address_num, '', $address));
+  return $address_output;
+}

It's too bad that Moneris wants the street number separated out, but I don't really think that there's a much better way of doing it. Right now, though, this function will also produce errors if the $address_num is never set.

What is the best way to debug with and without the patch? Is using the Moneris Sandbox account enough?

Hi xmacinfo,

The sandbox account allows you to simulate AVS and CVD response codes by passing Moneris different transaction amounts, but it won't actually validate the information. The Moneris developer portal has a document on how to simulate these responses titled "Test Environment eFraud (CVD & AVS) Result Codes", which is located in their "Other useful stuff" section:

https://developer.moneris.com/Downloads/Canada/Support/Other%20Useful%20Stuff.aspx (You'll need to sign up for a developer account if you don't already have one)

Without access to a production environment (which I unfortunately don't have at the moment), the best you can do is ensure that AVS and CVD information is being passed correctly to Moneris in the API call, in addition to making sure that the module is handling the response codes correctly.

Best,
Scott

I have been working on a new version of this module for one of our clients. It seems to be ready now, going through some final testing, and is available on GitHub. Just sent a message to Ionut to add me as a co-maintainer so I could push it to d.o. as well (as branch 7.x-2.x).

Feel free to give it a test ride, all input is highly appreciated.

Obviously it supports eFraud (AVS+CVD) as well.

Marking as fixed as this has been addressed in 2.x; any new issues related to 2.x can be opened separately.