Hey Rick,

I sent you an email but perhaps it was swallowed up in some junk filter. Since others might find this useful, I'll post it here...

I put Justin's code in a complete workflow task (attached to this post). To use this on your site do this:

<OL>
* Copy RemoveCreditCardNumber.vb to the App_Code directory of your BVC5 web site.

<LI>open App_Code/TaskLoader.vb in an editor and find this line:

Dim result As New Collection(Of BusinessRules.OrderTask)
</LI>
<LI>Add this line right after the line above:

result.Add(New RemoveCreditCardNumber)
</LI>
* Save the file.

* Launch the BVC5 Admin Pages for your site in a browser.

* Click on the Options tab and then select Workflows from the menu right below the tabs.

* Edit the Payment Changed workflow.

* Select "Remove Credit Card Number" from the list on the left and click on the New button.

* Verify that the Remove Credit Card Number appears at the bottom and then click on the OK button.

* Edit the Process New Order workflow.

* Repeat steps 8 and 9.
</OL>
That's it. This will remove the credit card number after it has been captured for new orders and if you add a credit card charge later.

You will probably need to repeat steps 2 and 3 each time you apply a BVC5 Service Pack. Please let me know if you have any questions.

Andy Miller
Princeton '82

P.S. I'm often amazed at the small world I live in...I think we may have been on on OA trip together at one time.

I used your fix as well Andy. Works great. Thanks. It is something we have been looking for.

In BV4 you could set a CC retention time but I don't see this feature in BV5. It is a concern because I like to leave the automatic login feature in the on position. Removing the CC number during checkout adds further security to our site. I couldn't figure out how get the CC refund to work from our site to Linkpoint anyway so retention is not an issue. I just do it on our CC Processors site and do a manual neg payment on ours to get everything to balance.

Now my question is, How do I remove the existing CC numbers from my order history with out screwing up our data base?

(Novice admin here.)

Thanks.

Bob Noble

The credit card info is all encrypted in the oder payments table. Even the one with all zeros or blank spaces. And that scared me. It looks like it could be a required field. Not sure what would happen if I messed with that.

I tried going back to the original order and change the CC number there but there isn't any update button.

Guess I'll wait and see what BV has to say about it or until I get some clarification on what the ramifications would be.

Bob Noble

I'm not sure...if you select the order (in BVAdmin > Orders) and pretend you are going to refund the payment, does it show 0000?

That did it. Checking the 'Display Full Credit Card Information In Admin Console?' to yes in Admin/Options/Credit Card and then looking up the Order showed the decrypted string of zeros. The other thing that was interesting is when you are looking in the Order Payments section it has a text box for the CVV but that was empty. I was thinking of adding another line to your code to also set the CVV to 000

payment.CreditCardCVV = "000"

but when I look at the bvc_OrderPayment table there is no column to hold the CVV. The question then is why is there a textbox for CVV (also on the NewOrder.aspx page). Is it just passed to the payment processor and discarded or is it supposed to be recorded in the database? I would presume that if you have to issue another charge or a chargeback you would need it.

The other little thing I noticed is that there are 'What is this?' links on both of those pages next to the CVV textbox that point to a page bvadmin/orders/CVV.aspx but there is no such page.

Rick

Hey! Guess what?

All my preexisting credit card numbers (before I used Andy's fix) now all appear to have been replaced with Zeros. At least they are when I look at them in the payments section of the order.

BV4 had an option erase CC numbers after 7 days. I wonder if Andy's fix triggered that 7 day feature.

In any event I now feel really comfortable with with leaving the auto log on feature in the on position. The only customer information that can be compromised now is names, addresses, phone numbers and clinics that have been purchased. Almost all of this information can be found by going to our clinic and checking the phone directory.

Thanks Andy.

Bob Noble

This application quit working when I upgraded to SP2. Apparently BV fixed the whole App_Code directory.

Anybody got a fix for this application? I made a wild guess on what that change might be but it would be dumb luck if I was right.

Thanks for your help.

Bob Noble

Thanks Andy. I chose Option 2. It works like a charm without any additional modifications.

Bob Noble