X-Cart forums

[balinor]

Ok, now I am getting upset. I have over 250 clients running pre-4.3 versions of X-Cart, all with custom designs that do not easily or cheaply upgrade to 4.3. I assured them that Qualitaem would be providing X-Payments for their versions of X-Cart, as there is no way I can upgrade that many clients in that short of a timeframe to 4.3, nor do any of them want the expense of that upgrade for what scant new features 4.3 offers.

You are CLEARLY not understanding your customer's needs. The vast majority of your customers use X-Cart with a payment gateway such as authorize.net which allows their customers to process payments ON their site. No one wants to send their customers to an external gateway, it makes the site look unprofessional and frankly, scares a lot of customers into thinking they are getting scammed.

So, to make it perfectly clear, you absolutely NEED to release X-Payments for 4.0, 4.1, and 4.2 in addition to 4.3. Stop whatever work you are doing on 4.4 and the legendary 'v5' and get this done. We have a few months left to get this working right, you need to devote all of your efforts into making your existing client base happy, or you are going to experience a mass-exodus to alternative carts who DO consider their customers needs.

Please take this seriously, I have stood behind your product for years, both to my clients and to members of this community, but if you fail to come through on this one, my position will change VERY quickly.

[geckoday]

Originally Posted by BCSE

We have many clients needing to stick with earlier versions of X-cart for various reasons. We'll likely create a way to use X-payments with the earlier versions. From my understanding it's the connector between X-payments is what needs to be changed, not X-payments. So we wouldn't have to touch any code that needs to be certified. We're researching this now so we can have a full plan for our customers. Feel free to drop us an email if you want to be notified when we have several options available to help people with this transition.

Thank you,

Carrie

You are correct you won't have to touch the X-Payments certified code. After working with the X-Payments alpha I don't think it will be a lot of work to support 4.0, 4.1 and 4.2. I don't know why X-Cart is so reluctant to fully support them. Unless they have changed things since the alpha, one thing you'll have to watch out for is the requirement to be running PHP 5.3.x. Versions of X-Cart prior to 4.3 will need a couple of patches to eliminate all of the deprecated messages (assuming you run X-Cart and X-Payments on the same server). Honestly, unless X-Cart has removed the requirement for PHP 5.3.x, I suspect that may be one of the bigger hurdles for many people. Unless we hear otherwise from the beta testers or X-Cart themselves, anyone planning on moving to X-Payments should be talking to their host now about upgrading to PHP 5.3.x.

[cflsystems]

Well said balinor

[BCSE]

Originally Posted by geckoday

You are correct you won't have to touch the X-Payments certified code. After working with the X-Payments alpha I don't think it will be a lot of work to support 4.0, 4.1 and 4.2. I don't know why X-Cart is so reluctant to fully support them. Unless they have changed things since the alpha, one thing you'll have to watch out for is the requirement to be running PHP 5.3.x. Versions of X-Cart prior to 4.3 will need a couple of patches to eliminate all of the deprecated messages (assuming you run X-Cart and X-Payments on the same server). Honestly, unless X-Cart has removed the requirement for PHP 5.3.x, I suspect that may be one of the bigger hurdles for many people. Unless we hear otherwise from the beta testers or X-Cart themselves, anyone planning on moving to X-Payments should be talking to their host now about upgrading to PHP 5.3.x.

That's what I saw as well when I played with the Alpha. We can work around the php 5.3.x requirement and create a patch for that as well. I don't see an issue initially with it. We are working on several different options for X-cart users of varying changes needed to be made to hopefully meet everyone's needs and budgets.

Carrie

[canuck]

Originally Posted by radionov

Dear customers,

We encourage you to take part in beta testing of X-Payments 1.0, a new product, which allows to make your e-commerce business processes compliant with PCI DSS v 1.2. standard requirements.

I would like to volunteer to beta test with our 4.1.10 modified site, or possibly concurrently on a stock, more recent site. Either we can test directly and/or if the folks at BCSE for example want a play area we could work together.

[zorg]

Sorry for not replying fast. Some rework of X-Cart PCI-DSS implementation guide (http://help.qtmsoft.com/index.php?title=X-Cart:PCI-DSS_implementation_guide) has been made highlighting the options:

a) to have credit card data entered on X-Cart side
b) to have credit card data stored on X-Cart side

[jillsybte]

OK, I confess I'm having trouble following all of this so I'm just going to ask what I have to do in order to continue using my X-Cart as I have for over 2 years.

First of all, thank you balinor for speaking so well on behalf of all of us. The biggest reason I bought X-Cart was to move from PayPal Standard (customers leave site to pay) to PayPal Pro. I do NOT want to have customers leaving my site to pay.

I do not store any CC, checking account, or CVV numbers at all; I never have and never will. I have McAfee ScanAlert scan my site quarterly and I am PCI compliant now based on that.

While I'm willing to consider other payment methods/gateways if necessary, I positively want to continue having my customers pay at my site.

I use 4.1.8 Gold and doubt I will be moving to a new version before July. What exactly do I have to do in order to continue using 4.1.8 and have customers pay via CC at my site (preferably while remaining with PayPal Pro)?

[necroflux]

Sorry for not replying fast.

Oh, that's cool! It was nice that you replied with information that completely ignores and pertains in no way to the majority of posts in this thread. I'm sorry but what a joke of a company...

[FiberGuy]

Originally Posted by balinor

You are CLEARLY not understanding your customer's needs. The vast majority of your customers use X-Cart with a payment gateway such as authorize.net which allows their customers to process payments ON their site. No one wants to send their customers to an external gateway, it makes the site look unprofessional and frankly, scares a lot of customers into thinking they are getting scammed.

So, to make it perfectly clear, you absolutely NEED to release X-Payments for 4.0, 4.1, and 4.2 in addition to 4.3. Stop whatever work you are doing on 4.4 and the legendary 'v5' and get this done. We have a few months left to get this working right, you need to devote all of your efforts into making your existing client base happy, or you are going to experience a mass-exodus to alternative carts who DO consider their customers needs.

I can't help but to emphasize the importance of Balinor's post above. (Thank you, Padraic, for wording this so simply and accurately.

V.5 seems like a pipe dream to me... it's been talked about and "oooh'ed" and "aaah'ed" with all the new features it will have.

If V.5 is what is holding back getting the vast majority of x-cart customers PCI-DSS certified come July, the SCRAP THE BLOODY THING... or at least, put it on hold ENTIRELY.

GEEZ.

Qualiteam, you are putting your customers in a very, VERY difficult and potentially VERY COSTLY situation. If I treated my customers this way, I would EXPECT them to leave.

[verbic]

Wow! Situation came to the boiling point here. We will try to clarify situation as the whole thread seem to be a sequence of misunderstandings.

Most of merchants here believe that they have to implement X-Payments or similar solution in their store by July if they are using background payment gateways such as Authorize.net AIM.

But, they don't have to!

Merchants may have to use PA-DSS certified solution (e.g. X-Payments) only if they store credit card information on site. In this case they have to submit the most strict Self Assessment Questionnaire type D (https://www.pcisecuritystandards.org/pdfs/pci_saq_d.pdf), which also applies to banks, payment gateways etc. Conforming SAQ D is a tough task and X-Payments implements a number of security measures that make the compliance much easier.

The typical user of background payment gateways do not store CC data on site therefore they have to fill Self Assessment Questionnaire type C (https://www.pcisecuritystandards.org/pdfs/pci_saq_c.pdf) which is much easier to conform:
Basically you need to follow simple PCI-DSS implementation guide published at our help portal: http://help.qtmsoft.com/index.php?title=X-Cart:PCI-DSS_implementation_guide
It explains how to disable storing CC numbers in X-Cart database (which is actually X-Cart default behavior).

So the conclusion is: if you do not store CC information on site then X-Cart should not prevent you becoming PCI-DSS compliant. However you need to remember that you also have to apply additional security measures not related to shopping cart software like anti-virus software, employee related policies etc. For details see SAQ C: https://www.pcisecuritystandards.org/pdfs/pci_saq_c.pdf


I believe that the situation became more transparent now. If you have other PCI-DSS related questions, please post them here.