Warning - WorldPay 'Flaw'

[Garreg]

If you use WorldPay - please be careful......

Sadly after much waiting the WorldPay feature is a complete let down
Having set the system up and then tried a ‘test’ run I noticed that when the new user reaches the page – ‘Click on the button below to pay the invoice via WorldPay. Be patient, the procedure may take some time’ they are also able to edit the amount payable…….!

Which means that unless you actually moderate ever new account sign up and double check that the amount paid is actually what you set for the hosting account – they could rip you off by paying less…!

Very disappointed with PSOFT – such a major ‘glitch’ in the system makes it virtually unusable – haven’t tried the PayPal system – but for those who may use it I suggest you double check it before going live.

Anyone got a workaround / ideas ?

[admin]

Thanks for the feedback.. I will make sure to point this out to psoft..

[Garreg]

Any feedback on this?

[admin]

)
.... (my comments regarding some users, after heaving hard day of work).


We specifically made it posible for user to edit this amount. (There is also no way to prevent user from changing it, but creating his own form).
Anyway, we made it posible, but the system actually does the validation of what was entered. WorldPay supports callback url + verification.
That means, that when user enters the amount and pays, the callback url is called, with the amount that was paid. There are small verification process to make sure that this callback wasn't faked.
After that we credit that amount to the account.
If account wasn't create:
1) amount is smaller then needed - account will not be created, yet amount paid will be displayed in moderate queue
2) amount is larger then or equeals to what is needed - account will be created, and that amount will be credited to the new account (this might result in positive credit).


The same is true when user adds funds to his account.

[Garreg]

Thanks for the reply.

We specifically made it posible for user to edit this amount.

What host sells an item for one amount and then allows the user to add another - How pathtic!

Anyway, we made it posible, but the system actually does the validation of what was entered. WorldPay supports callback url + verification.

I've been using WorldPay for a number of years and have written my own and clients software for it - they obviously have no idea about 'call backs' and 'verification'.

That means, that when user enters the amount and pays, the callback url is called, with the amount that was paid. There are small verification process to make sure that this callback wasn't faked.

Oh no it doesn't.... Ive created an account - all that happens is that the transaction is processed with the amount transferred via the system.
They never even took the trouble to include a 'test' option in the system - making every transaction live......

PSoft are taking out thier backside - and you can relay that....