Loaded Commerce Community

Banner


Board index » Loaded Commerce Support » Feedback

All times are UTC - 5 hours




Post new topic Reply to topic  [ 8 posts ] 
Author Message
 Post subject: BUG in 6.2 PRO Patch 08 with Credit Card Encryption
PostPosted: Wed Oct 04, 2006 5:54 pm 
Offline
CRE Freak
User avatar

Joined: Tue May 23, 2006 12:00 am
Posts: 99
Location: NC
I was not sure where to post a bug that I have found, but there is a bug in the Credit Card Encryption.

It really messes up the CC Numbers and Expiration dates in the Order. It also seems to have corrupted them in the Database, as it still will not show them correctly when I disable the Encryption.

I know that Minkglove was also having this problem, as we both verified this in Patch 07.

Let me know what else you might need from me.

Bryan

_________________
http://www.karaoke-computers.com/


Top
 Profile  
 
 Post subject: Re: BUG in 6.2 PRO Patch 08 with Credit Card Encryption
PostPosted: Wed Oct 04, 2006 6:07 pm 
Offline
CRE Freak
User avatar

Joined: Tue May 23, 2006 12:00 am
Posts: 99
Location: NC
I just noticed their is a test under the Encryption for the Credit card, maybe I have to do something else, that I am not doing. Anyways, here is what that Test states on my version.

Mcrypt Algorithms and Modes
Algorithm Status CBC CFB CTR ECB NCFB NOFB OFB STREAM
CAST-128 OK OK OK OK OK OK OK OK NOT TESTED
GOST OK OK OK OK OK OK OK OK NOT TESTED
RIJNDAEL-128 OK OK OK OK OK OK OK OK NOT TESTED
TWOFISH OK OK OK OK OK OK OK OK NOT TESTED
ARCFOUR OK NOT OK NOT OK NOT OK NOT OK NOT OK NOT OK NOT OK NOT TESTED
CAST-256 OK OK OK OK OK OK OK OK NOT TESTED
LOKI97 OK OK OK OK OK OK OK OK NOT TESTED
RIJNDAEL-192 OK OK OK OK OK OK OK OK NOT TESTED
SAFERPLUS OK OK OK OK OK OK OK OK NOT TESTED
WAKE OK NOT OK NOT OK NOT OK NOT OK NOT OK NOT OK NOT OK NOT TESTED
BLOWFISH-COMPAT OK OK OK OK OK OK OK OK NOT TESTED
DES OK OK OK OK OK OK OK OK NOT TESTED
RIJNDAEL-256 OK OK OK OK OK OK OK OK NOT TESTED
SERPENT OK OK OK OK OK OK OK OK NOT TESTED
XTEA OK OK OK OK OK OK OK OK NOT TESTED
BLOWFISH OK OK OK OK OK OK OK OK NOT TESTED
ENIGMA OK NOT OK NOT OK NOT OK NOT OK NOT OK NOT OK NOT OK NOT TESTED
RC2 OK OK OK OK OK OK OK OK NOT TESTED
TRIPLEDES OK OK OK OK OK OK OK OK NOT TESTED

Maximum Key Sizes Allowed
Algorithm Maximum Key Size
cast-128 16
gost 32
rijndael-128 16 24 32
twofish 16 24 32
arcfour 256
cast-256 16 24 32
loki97 16 24 32
rijndael-192 16 24 32
saferplus 16 24 32
wake 32
blowfish-compat 56
des 8
rijndael-256 16 24 32
serpent 16 24 32
xtea 16
blowfish 56
enigma 13
rc2 128
tripledes 24

_________________
http://www.karaoke-computers.com/


Top
 Profile  
 
 Post subject: Re: BUG in 6.2 PRO Patch 08 with Credit Card Encryption
PostPosted: Wed Oct 04, 2006 6:43 pm 
Offline
CRE Legend

Joined: Sun Nov 09, 2003 1:00 am
Posts: 7301
Location: Baconton, GA USA
bry21317 wrote:
I was not sure where to post a bug that I have found, but there is a bug in the Credit Card Encryption.

It really messes up the CC Numbers and Expiration dates in the Order. It also seems to have corrupted them in the Database, as it still will not show them correctly when I disable the Encryption.

I know that Minkglove was also having this problem, as we both verified this in Patch 07.

Let me know what else you might need from me.

Bryan


There is a link to the bug tracker in the Admin Home page of every stock copy of CRE Loaded. That is the best place to report bugs.

David

_________________
My CRE Loaded FAQ List
CRE Loaded Hosting


Top
 Profile  
 
 Post subject: Re: BUG in 6.2 PRO Patch 08 with Credit Card Encryption
PostPosted: Wed Oct 04, 2006 7:37 pm 
Offline
CRE Freak
User avatar

Joined: Tue May 23, 2006 12:00 am
Posts: 99
Location: NC
I don't see this Bug Tracker.

I am on the Home Page of my 6.2 Pro Patch 08, White Label version, I see the following links at the top:

CRE Loaded Pro B2B Now Released

Now on creloaded.com

osCommerce.com | CRE Loaded.com Admin Home | View Catalog | CRE Forums | Purchase CRE Support | Certified CRE Hosting

But I don't see anything about a Bug Tracker.

_________________
http://www.karaoke-computers.com/


Top
 Profile  
 
 Post subject: Re: BUG in 6.2 PRO Patch 08 with Credit Card Encryption
PostPosted: Wed Nov 01, 2006 9:53 am 
Offline
CRE Legend
User avatar

Joined: Fri Jan 13, 2006 1:00 am
Posts: 11084
Location: Nappanee Indiana
its in the news feed box right side

_________________
Jason Miller
https://www.creloadedexpert.com
CRE Loaded Expert Team
CRE Loaded Support
Home of the FIRST 100% tableless CRE Loaded template


Top
 Profile  
 
 Post subject: Re: BUG in 6.2 PRO Patch 08 with Credit Card Encryption
PostPosted: Wed Nov 01, 2006 10:17 am 
Offline
CRE Freak
User avatar

Joined: Sun Apr 17, 2005 12:00 am
Posts: 135
bry21317, I would make sure you try and recover the file includes/key/cc_key.php from your prior installation. The patch 8 OVERWRITES this file, and if you had a different key prior to the patch then the result is corruption of data, since the key changed without decrypting and reencrypting the DB first.

If you never changed the encryption key, then with patch 7 and earlier the key was CC_KEY. You need to modify the includes/key/cc_key.php file or use the admin interface to set the value of CC_KEY = CC_KEY. Essentially it wasn't defined before patch 8, so PHP would pick up the value as CC_KEY.


Top
 Profile  
 
 Post subject: Re: BUG in 6.2 PRO Patch 08 with Credit Card Encryption
PostPosted: Wed Nov 01, 2006 12:11 pm 
Offline
CRE Freak
User avatar

Joined: Sun Apr 17, 2005 12:00 am
Posts: 135
I have a few more comments on this subject, that I wanted to share.

There is some work in this area that is necessary to improve the feature. Hopefully it will be pulled together and cleaned up a bit for the 6.3 release.

I know not everyone is a fan when people compare product A to product B, but I think it is healthy to have competition and for people to understand what the competition is doing. In any case, here I go...

X-Cart has the concept of
a) embedding an algorithm id in the crypted data, and
b) embedding a crc-32 in the crypted data.

Both of these ensure that encryption/decryption issues like this can be captured and alerted to the store admin.

Additionally it would be a really really good idea if includes/key/cc_key.php was added to the global-ignores in the repository, excluded from future patches, and this file was generated with a RANDOM key at installation time.


Top
 Profile  
 
 Post subject: Re: BUG in 6.2 PRO Patch 08 with Credit Card Encryption
PostPosted: Fri Feb 02, 2007 6:30 pm 
Offline
CRE Legend
User avatar

Joined: Fri Jan 13, 2006 1:00 am
Posts: 11084
Location: Nappanee Indiana
good points

_________________
Jason Miller
https://www.creloadedexpert.com
CRE Loaded Expert Team
CRE Loaded Support
Home of the FIRST 100% tableless CRE Loaded template


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 8 posts ] 

Board index » Loaded Commerce Support » Feedback

All times are UTC - 5 hours


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
It is currently Wed May 23, 2012 9:01 pm
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group

Login

Forums Latest Activity

Top Listing

1. Cart2Cart - Shopping...
    Category: Shopping Cart Database Conversion Scripts
    
2. Points & Rewards PLUS!...
    Category: Add-Ons
    
3. Configuration Server...
    Category: Fixes
    
4. Credit Card with CCV
    Category: Payment Modules
    
5. CC7333_ATS
    Category: Templates
    
Show more...

© CRE Loaded is a product of Chain Reaction Ecommerce, Inc. Usage & Privacy Policy