The payment module IDEAL Lite | Ubercart Payment loads a picture from an external site named www.qspeed.nl (hard coded) when it displays the splash screen just before going to the secure banking environment. I consider this a privacy breach. It provides the external server an effective way of counting and time stamping payment transactions (what I consider confidential for my webshop).
The code in question is in module version 6.x-1.1 in the file uc_ideal_lite_payment.module at line 328:

Only local images are allowed.

The security team has cleared this issue to be fixed publicly

CommentFileSizeAuthor
#6 uc_ideal_lite.zip28.76 KBfietserwin

Comments

sutharsan’s picture

sutharsan commented

Any progress on this issue? or at least an explanation of why you place adds in your modules?

dagomar’s picture

dagomar commented

I completely agree with Luna here.

keesje’s picture

keesje commented

That this could be (mis)used this way has never occurred to me, but it could. For reasons why, the module initially borrowed some code from the Ogone module, early days. This pic had to be forced behind https to prevent IE from spitting security warnings in some circumstances "mixed secure/unsecure content". I agree that this part of the code should be removed for this public release.

keesje’s picture

keesje commented
Status: Active » Needs work

Please feel free to post patches regarding this.

tom_buytaert’s picture

tom_buytaert commented

can't you just remove this image?

fietserwin’s picture

fietserwin
Location Le Mont-Dore
commented
Status: Needs work » Needs review
StatusFileSize
new uc_ideal_lite.zip28.76 KB

I did a complete code clean-up of this module that among others:

- removes the image mentioned in this issue
- Dutch translation file
- streamlining code
- code clean-up
- streamlining css
- more comments
- better session storage handling (that is: remove session storage when no longer needed, remove unused session storage)
- output xhtml
- DOM compliant JS: (getElementByID instead of document.myId,...)

Tested with ING only, but as the interface is the same, Rabobank should not give any problem.

Feel free to download and use the attached version and comment on it if you find any problems/remarks. The .org files are the original files, so you can see what changed

keesje’s picture

keesje commented
Issue summary: View changes
Status: Needs review » Closed (won't fix)

Module is obsolete