X-Cart:X-Payments Connector
X-Payments Connector is an add-on module for X-Cart that provides an interface to connect X-Cart to X-Payments, a PA-DSS v 1.2 verified payment application intended for web stores accepting online credit card payments through background payment gateways. X-Payments Connector ensures correct implementation of the following tasks:
- Importing the data on active payment methods from X-Payments to X-Cart;
- Transferring cart and customer details from X-Cart to X-Payments;
- Redirecting the customer from X-Cart to X-Payments and back to X-Cart;
- Synchronizing transaction and order details between X-Payments and X-Cart.
System requirements
To successfully install and use the X-Payments Connector add-on module, you must have:
- Installed copy of X-Cart Gold/Pro v4.3.0 or later;
- Installed copy of X-Payments v 1.0 or later;
- PHP extensions:
- libCurl version >= 7.10;
- OpenSSL extension;
- XML DOM extension (to parse XML data).
Installing X-Payments Connector
To install the module:
1. Obtain a distribution package for X-Payments Connector by downloading it from the File Area section of your personal Help Desk account at https://secure.qtmsoft.com/ . The distribution package you need is contained in an archive file x-paymentscon-x.y.z.tgz where x, y and z are the version numbers of the module, which must be the same as the version of the installed copy of X-Cart.
3. Put the distribution package to the X-Cart root directory on your server or hosting account.
- If you use a Windows-based server, or a Unix-based server without terminal access:
- a. Decompress the archive with the distribution package to a directory on your system using your favorite compression program (WinZIP or any other archiver with support for TAR files).
- b. Use an FTP client to upload all files contained in the archive (retaining the directory structure) to the X-Cart root directory on your server or your hosting account.
- If you use a Unix-based server with terminal access:
- a. Use an FTP client to upload the archive with the distribution package to the X-Cart root directory on your server or your hosting account.
- b. Decompress the package using one of the following commands:
gunzip < x-paymentscon-x.y.z.tgz | tar -xvf -
or
tar -xzvf x-paymentscon-x.y.z.tgz
3. In a web browser, run the installation script http://example.com/install-xpaymentscon.php replacing example.com with the true domain name of your X-Cart installation.
4. Follow the instructions on the screen.
Configuring X-Payments Connector
Before you can start using X-Cart together with X-Payments, you must configure X-Payments Connector.
To configure X-Payments Connector:
1. Log in to the X-Cart Admin area.
2.Go to the Modules section (Administration menu -> Modules).
3. If not selected, select the check box for X-Payments Connector and click Update. This will activate the module.
4. Click on the Configure link for X-Payments Connector.
This will open the X-Payments Connector configuration page.
5. Define connection details.
- Store ID: A unique value generated in the X-Payments back-end for a particular store. This value allows X-Payments to correctly identify requests coming from this store.
- X-Payment URL: The URL of your X-Payments installation. Make sure the URL is specified correctly, otherwise the module will not be able to connect to X-Payments.
- Encryption key: A key to encrypt requests that the store sends to X-Payments. The key is generated in the X-Payments back-end.
- Decryption key: A key to decrypt responses and callback requests that the store receives from X-Payments. The key is generated in the X-Payments back-end.
- Decryption key password: A password to decrypt the Decryption key. The password is generated in X-Payments back-office.
- IP addresses for X-Payments callbacks: A comma-separated list of X-Payments IP addresses that are used by X-Payments to send callback requests.
6. Establish mapping rules.
Mapping rules are used to synchronize transaction statuses in X-Payments with statuses of respective X-Cart orders. To associate an X-Payments transaction status with an X-Cart order status, choose the order status from the drop-down box in the column on the right.
For example, if you associate the entry "Set order status for 'Charged' payment to" on the right with the value "Processed" from the drop-down box on the left, changing the status of an X-Payment transaction to "Charged" will automatically change the status of the respective order in X-Cart to "Processed".
7. Click the Save button.
Contents
- 1 System requirements
- 2 Installing X-Payments Connector
- 3 Configuring X-Payments Connector
- 4 About PCI DSS
- 5 Configuring X-Cart to meet PCI DSS (cardholder data is not stored)
- 6 Configuring X-Cart to meet PCI DSS with X-Payments application
- 7 Passing network security scans
- 8 Submitting a self-assessment questionnaire
- 9 FAQs
- 10 See also
PCI Compliance is increasingly important to all online store owners, and X-Cart can be implemented to meet this standard. Follow the steps when implementing X-Cart in a PCI compliant manner.
About PCI DSS
PCI DSS stands for Payment Card Industry Data Security Standard, which is a worldwide information security standard assembled by the major credit card vendors, including American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa, Inc. The standard was designed to help organizations involved in processing credit card payments online make their payment systems secure from cardholder data fraud.
PCI DSS specifies 12 requirements broken into 6 groups for compliance that apply both to hardware and software parts of the system that is used to collect, store, transmit and process valuable credit card data as well as the human factor.
| Build and Maintain a Secure Network |
|
| Protect Cardholder Data |
|
| Maintain a Vulnerability Management Program |
|
| Implement Strong Access Control Measures |
|
| Regularly Monitor and Test Networks |
|
| Maintain an Information Security Policy |
|
Some aspects of implementing PCI DSS were discussed in the webinar about PCI compliance for online merchants hosted by X-Cart and McAfee in September 2012. A record of this webinar can be found here: http://www.youtube.com/watch?v=vzLUbQojfBA
Configuring X-Cart to meet PCI DSS (cardholder data is not stored)
Disable collecting of credit card data at user registration
If forced, X-Cart can collect customers' credit card details during registration. This is controlled via two check boxes in the section General Settings / General Options of the Admin area:
- Do not ask customers to enter CC information while getting registered: Defines if a customer will be asked to provide credit card details during registration;
- Display CVV2 input box on the registration form and at the last stage of checkout if Manual CC processing is used...: Defines if a customer will be asked to provide CVV2 during registration.
Asking for credit card data during registration must be disabled as shown in the picture below.
Disable storing credit card data in X-Cart database
If forced, X-Cart can store valuable credit card data in an encrypted database. This is controlled via three variables in the main configuration file <xcart_dir>/config.php. You must set the value of all the three variables to false (which is the default setting), and no credit card will be stored in the X-Cart database then.
# file <xcart_dir>/config.php
$store_cc = false;
$store_cvv2 = false;Remove historical data
Removing historical data, such as card validation codes and other credit card information after the orders using it have been processed and completed, is absolutely necessary for PCI DSS compliance. To remove this data, use X-Cart's Remove credit card information tool.
Disable Subscriptions module
When the built-in X-Cart module Subscriptions is enabled, X-Cart keeps credit card data stored in its database. Follow these steps to disable the module:
- Log in to the X-Cart Admin area.
- Go to the section Modules (Administration module -> Modules)
- Deselect the check box for the entry Subscriptions.
- Click the Update button at the bottom of the page to save the changes.
Secure processing and transmission of cardholder data
The easiest way to deal with PCI DSS compliance is to use web-based payment gateways to eliminate the need for customers to enter credit card details on your web-site and thus reduce efforts on meeting PCI DSS compliance requirements. X-Cart is secure and supports quite a number of such “offsite” payment gateways like Paypal Express Checkout, Google Checkout, Checkout by Amazon, WorldPay, 2Checkout, Authorize.net SIM and many more.
If your store has a background payment method enabled, customers input their credit card data on the X-Cart side at the final step of checkout. It is highly recommended to disable background payment methods using the Settings menu -> Payment methods section of the X-Cart admin back-end. In this case you'll have to fill out the simplest of PCI Self-Assessment Questionnaires (SAQ A).
If you want credit card data to be entered on X-Cart side, it's necessary to make sure that your store is implemented in a PCI compliant hosting environment and your X-Cart is set up in a PCI compliant manner, i.e. you use a PA-DSS certified software to process credit card payments. You'll have to fill out PCI SAQ C in this case.
Configuring X-Cart to meet PCI DSS with X-Payments application
Why use X-Payments
X-Payments is designed for merchants who accept credit card payments using background payment gateways. Being a PA-DSS certified solution, X-Payments helps merchants to meet PCI standards. Connecting X-Payments to X-Cart saves merchants time and money when it comes to complying with PCI DSS.
Understanding PA-DSS
If a software application stores, transmits or processes sensitive cardholder data the application must be PA-DSS compliant.
- Requires all payment applications be certified by an approved Payment Application-Qualified Security Assessor (PA-QSA). PA-QSAs are third-party security auditors, certified by the PCI Security Standards Council (PCI SCC) to verify that payment applications meet specified security standards
- PA-DSS payment applications must be implemented in a PCI DSS compliant environment
Becoming compliant is easy
Qualiteam has helped to make PCI compliance easier for merchants by separating the X-Payments application from the X-Cart platform. There are two important benefits of this design:
- Only the actual payment application has to be certified and compliant - rather than the entire platform
- X-Cart can be upgraded and customized without affecting the overall PCI compliance provided by X-Payments
See the following pages on how to set up a secure X-Cart with X-Payments in a PCI DSS manner:
To become compliant SAQ C must be completed.
Passing network security scans
Once the software is configured properly you (or your service provider / webhosting) must locate an Approved Scanning Vendor (ASV), who will conduct a network scan to ensure that the safety requirements highlighted above are actually functional and not just placeholders in the self-assessment questionnaire required for Level 2, 3 and 4 merchants and service providers.
The purpose of the scan is to locate vulnerabilities in the system that can lead to data breaches and diagnose & recommend measures to fix these problems. The ASV submits a report to the PCI highlighting the potential security holes and the level of vulnerability from 1-5 (but this time, a Level 5 is the highest point of vulnerability). In case of a level 1 merchant, an on site assessment is also mandated by the PCI, to be conducted by a Qualified Security Assessors (QSAs).
Submitting a self-assessment questionnaire
Finally, a self-assessment questionnaire on a prescribed format needs to be submitted to the acquiring bank, which acts as a checklist to ensure that the 12 requirements outlined above have been addressed and met. Consult the instructions on how to complete the SAQ.
FAQs
Does PCI DSS allow to use background payment methods with X-Cart ?
No, this is not allowed. Since X-Cart is not a PA-DSS certified software you should configure it to avoid transmitting credit card data from your store to payment gateway by:
- disabling background payment methods in your store
- or #Configuring X-Cart to meet PCI DSS with X-Payments application
Is it allowed to store cardholder data (credit card numbers, expiration info, etc) in X-Cart database ?
As per PCI DSS recommendations, you should avoid storing cardholder data electronically unless there is a legitimate business reason to do it; moreover sensitive authentication data (for example CVC2/CVV2) MUST NOT be stored at all. When using X-Cart you should disable collecting and storing of credit card data.
See also
- X-Cart:Store Security
- X-Payments website
- PCI FAQs
- PCI Security Standards Council website
- Braintree PCI DSS compliance Quick Guide
|
