X-Cart forums - Last Four of Credit Card in Invoice Emails

X-Cart forums (https://forum.x-cart.com/index.php)

- Changing design (https://forum.x-cart.com/forumdisplay.php?f=51)

- - Last Four of Credit Card in Invoice Emails (https://forum.x-cart.com/showthread.php?t=46089)

joestern

03-06-2009 03:57 PM

Last Four of Credit Card in Invoice Emails

I want to add something saying, basically, "Your order was billed to the credit card ending XXXX" into my order confirmation emails. I've been working with this file:

/mail/order_invoice.tpl

and I know how to add in the right place, but I don't know how to extract this info from the system. I had X-Cart do it in my 3.7 customizations, but now I'm trying this round myself.

Has anyone done this? Any ideas?

balinor

03-06-2009 04:22 PM

Re: Last Four of Credit Card in Invoice Emails

You can't do that unless you store the CC info, which you can't do if you want to be PCI Compliant.

rogue

03-07-2009 04:19 AM

Re: Last Four of Credit Card in Invoice Emails

You could store the last 4 of the card. - - Modify the code that is already there that stores the card # to only store last 4 then use that on the invoice.

How do you give a credit if you don't have the card number later?

balinor

03-07-2009 05:55 AM

Re: Last Four of Credit Card in Invoice Emails

Using your payment gateway

joestern

03-07-2009 06:48 AM

Re: Last Four of Credit Card in Invoice Emails

So far, anyway, I am storing the CC numbers. I understand that this isn't recommended, and my next project is to work on my back end to make this unnecessary.

But since I am, is there a way to extract the number and mask it?

balinor

03-07-2009 08:23 AM

Re: Last Four of Credit Card in Invoice Emails

Sorry Joe, not something I am willing to assist with for security reasons.

joestern

03-09-2009 02:29 PM

Re: Last Four of Credit Card in Invoice Emails

I totally understand. I didn't get that it's related to a sensitive area - I'll just skip it in this upgrade. Probably customers would be happier these days with less info, in many ways.

joestern

03-10-2009 02:27 PM

Re: Last Four of Credit Card in Invoice Emails

So it looks like I can't even get the type of credit in here, is that right? Is it part of the encrypted area?

That's a problem for me because I have my in-house database parse the orders by credit card type so that I can match my batches to my Visa/MC settlements versus my Amex and Discover ones.

Is it possible that the credit card type is also stored elsewhere?

rshandel

08-03-2009 09:45 AM

Re: Last Four of Credit Card in Invoice Emails

Is it PCI compliant if we only store the last 4 digits of the credit card number?

rshandel

08-04-2009 07:24 AM

Re: Last Four of Credit Card in Invoice Emails

Rogue,

Could you point me in right direction so I can modify the code that stores the credit card number - I'd like to store only the last for digits of the cc in the database as well.

Thanks,

geckoday

08-05-2009 05:25 AM

Re: Last Four of Credit Card in Invoice Emails

Quote:

Originally Posted by rshandel

Is it PCI compliant if we only store the last 4 digits of the credit card number?

Yes, if you truncate the card number to the last 4 digits it is no longer considered a card number and you can store it. print it, etc. without worrying about PCI requirements.

rshandel

08-05-2009 05:46 AM

Re: Last Four of Credit Card in Invoice Emails

ok, thanks Ralph. Can you tell me which php file I can modify the cc number is before its being written to the db?

geckoday

08-05-2009 06:02 AM

Re: Last Four of Credit Card in Invoice Emails

Near the top of payment/payment_ccend.php is the code that stores the cc number.

geckoday

08-05-2009 06:24 AM

Re: Last Four of Credit Card in Invoice Emails

Quote:

Originally Posted by geckoday

Near the top of payment/payment_ccend.php is the code that stores the cc number.

Sorry, that is where it is stored in the customer table. payment/payment_cc.php stores it in the order. Search for store_cc to find the spot in the code that stores it.

rshandel

08-06-2009 06:53 AM

Re: Last Four of Credit Card in Invoice Emails

Thanks again, Ralph. I had modified that file already but didn't seem to write the "new card number":

$blank_card_number="1234";
if ($store_cc) {
$query_data = array(
"card_name" => $card_name,
"card_type" => $card_type,
#rs - blank out credit number in database
"card_number" => addslashes(text_crypt($blank_card_number)),
#"card_number" => addslashes(text_crypt($card_number)),
#/rs

Will this only rewrite using a gateway, i.e. authorize.net or will it also write the card number here when using credit credit manual payment method?

Also you mentioned payment/payment_ccend.php stores the cc number in the customer table as well; in order to be fully compliant, should I modify the cc code in this file as well? - I had also modified this file (same code as above) as well to no avail.... but haven't tried to process an order within our authorize.net gateway.

rshandel

08-06-2009 09:15 AM

Re: Last Four of Credit Card in Invoice Emails

I double-checked using our authorize.net payment gateway and its still writing the complete credit card number. Could X-Cart possibly be writing the cc number to mysql somewhere else??

geckoday

08-06-2009 10:34 AM

Re: Last Four of Credit Card in Invoice Emails

Yeah, I forgot about the goofy way the credit card number storage is done in 4.1. The spot you modified in payment_cc.php is for storing the cc number into the customer table for manual credit card processing. There is similar code in payment_ccend.php for storing the cc number into the customer table for gateway transactions. You should modify both.

The saving of the cc info into the orders table is the goofy part. This code in payment_cc.php is what does that:

PHP Code:


		
			
$_order_details_rval = array();
foreach (func_order_details_fields() as $_details_field => $_field_label) {
    if (isset($GLOBALS[$_details_field])) {
        $_order_details_rval[] = $_field_label.": ".stripslashes($GLOBALS[$_details_field]);
    }
}

It builds the order_details column for the orders table using the fields defined in func_order_details_fields. It would probably be best to modify $card_number to what you want stored in the orders table before this code and restore it afterwards to avoid problems elsewhere.

rshandel

08-06-2009 03:00 PM

Re: Last Four of Credit Card in Invoice Emails

Quote:

It would probably be best to modify $card_number to what you want stored in the orders table before this code and restore it afterwards to avoid problems elsewhere.

Thanks Ralph. Working in CC Manual mode right now. I now see that I can modify and write the last 4 digits to the customers table, but I'm having troubles with the code to modify card_number in the orders table.

This is what I have ...

Code:

#

# Make order details

#

$_order_details_rval = array();

foreach (func_order_details_fields() as $_details_field => $_field_label) {

    if (isset($GLOBALS[$_details_field])) {

        if ($_field_label eq "Card number") {

            $store_card_number=$card_number;

            $card_number = substr($card_number,-4);

            $_details_field = $card_number;

        }

        $_order_details_rval[] = $_field_label.": ".stripslashes($GLOBALS[$_details_field]);

    }

}

$card_number = $store_card_number;

thanks.

geckoday

08-06-2009 05:51 PM

Re: Last Four of Credit Card in Invoice Emails

Your if is testing the wrong variable/value. But just make life easier and move the code above the foreach loop and get rid of the if.

rshandel

08-07-2009 07:38 AM

Re: Last Four of Credit Card in Invoice Emails

Thanks Ralph! That was it. I tested for both manual and gateway processing and it works fine.

Thanks again for your help!

GFaulkner

01-21-2010 10:54 AM

Re: Last Four of Credit Card in Invoice Emails

I am trying to do a similar thing with the credit card number. Can you send over your finalized code that works?

Thanks,
Greg

rshandel

01-26-2010 08:26 AM

Re: Last Four of Credit Card in Invoice Emails

In payment_cc.php

Replace code between

#
# Make order details
#

and
#
# Only logged users can submit orders
#

with this:

Code:



#rs

            $store_card_number=$card_number;

            $card_number = substr($card_number,-4);

#/rs

$_order_details_rval = array();

foreach (func_order_details_fields() as $_details_field => $_field_label) {

    if (isset($GLOBALS[$_details_field])) {

        $_order_details_rval[] = $_field_label.": ".stripslashes($GLOBALS[$_details_field]);

    }

}

#rs

        $card_number = $store_card_number;

#/rs

$order_details = implode("\n", $_order_details_rval);



$customer_notes = $Customer_Notes;

Then after
#
# If successful - Store CC number in database
#

add

Code:

#rs

$new_card_number==substr($card_number,-4);

#/rs

Find

Code:

            "card_number" => addslashes(text_crypt($card_number)),

Replace with:

Code:



            #"card_number" => addslashes(text_crypt($card_number)),

#rs

            "card_number" => addslashes(text_crypt($new_card_number)),

#/rs

In payment_ccend.php:

add

Code:

   #rs

            $store_card_number=$card_number;

            $card_number = substr($card_number,-4);

   #/rs

after

Code:



if ($bill_error) {

    $request = $current_location.DIR_CUSTOMER."/error_message.php?".$sessurl."error=".$bill_error.$reason;

}

else {

add

Code:

  #rs  

            $card_number = $store_card_number;

  #/rs

after

Code:



    if (!empty($active_modules['SnS_connector'])) {

        func_generate_sns_action("CartChanged");

    }

Good luck!

All times are GMT -8. The time now is 01:24 PM.