Paypal 2016 Merchant Security Upgrades

[KarenBM]

snap I just updated my post with that information. Good news there at least.

[Mike Hughes]

Yes, definitely good news.

[oginet]

PayPal payments not updating Sellerdeck Orders as paid

I've recently transferred a website from Prestashop to Sellerdeck 2016

Old website only accepted PayPal, and quite a proportion still want to pay by PayPal on new site.

New website is set up to take payment immediately, via Sellerdeck Payments or PayPal.

Those orders paid by PayPal appear incorrectly in 'Pending Payment Service Provider' , order confirmation page does not appear and customer doesn't get an emailed order confirmation. PayPal payments are being received to PayPal account OK.

S.Payments working as it should.

Not sure if previous posts in this area are the same problem as this on not.

[brucet]

We've been advised that PayPal are deferring their enforcement of TLS v1.2 until June 2017. See https://www.paypal-knowledge.com/infocenter/index?page=content&widgetview=true&id=FAQ1914 &
https://devblog.paypal.com/upcoming-...hanges-notice/.
The final deadline for enforcement across the internet was already deferred to 2018.

The date for enforcement for SellerDeck Payments has not yet been set. Other providers such as Sage Pay may go ahead with enforcement in June.

SellerDeck 2016 (v16.0.2), currently in Beta, provides support for TLS v1.2 for both PayPal and SellerDeck Payments desktop functions (website functions rely on the web host). This has required an update to the version of PHP included with the software.

If your site has any plugin or custom code that uses PHP, we strongly recommend testing it with the v16.0.2 Beta, as this upgrade will be the baseline for PHP and TLS v1.2 support in all versions going forward. We understand that no current plugins from Codepath or Mole End use PHP. Some plugins from Drillpine do use PHP, and plugins from other providers may do too.

[zgap111]

I've recently transferred a website from Prestashop to Sellerdeck 2016

Old website only accepted PayPal, and quite a proportion still want to pay by PayPal on new site.

New website is set up to take payment immediately, via Sellerdeck Payments or PayPal.

Those orders paid by PayPal appear incorrectly in 'Pending Payment Service Provider' , order confirmation page does not appear and customer doesn't get an emailed order confirmation. PayPal payments are being received to PayPal account OK.

S.Payments working as it should.

Not sure if previous posts in this area are the same problem as this on not.

I don't think it's related to this thread... but we have (and continue) to experience this problem.

I've done some analysis on our data:

Paypal PDT = Off = 60% Orders are received as PSP Pending
(76 days : 23 = 0%, 15 = 1%-99%, 38 = 100% : to PSP Pending)

Paypal PDT = On = 7% Orders are received as PSP Pending
(117 days : 99 = 0%, 15 = 1%-99%, 3 = 100% : to PSP Pending)

Paypal PDT = On + Pre-Auth = On : 6.2% Orders received as PSP Pending
(65 days : 53 = 0%, 12 = 1%-99%, 0 = 100% : to PSP Pending)

Sellerdeck support are suggesting our host is blocking Paypal IPs so it fails... I'm not so sure on this (our host confirms Paypal IPs are not blocked), our ticket on this issue is still on-going... If anyone else is having this same problem, please raise it with them... hopefully more reports will get them to look deeper into this problem.

[Mike Hughes]

For anyone using 1and1 I have checked my own shared hosting and it looks as if the update we were told would happen on 24th May has not happened yet.

The TLS check routine still fails and a discussion with 1and1 tech support suggests the update is a rolling one and they haven't been given any information on when it will be applied to specific servers.

The urgency for this happening soon has disappeared with paypal pushing out the requirement to 2017 but I'll try and keep track of when the update actually happens to make sure it does address the new paypal requirements.

As a check for this I'm using the TLS test routine from earlier in the thread and monitoring the perl version active on the server. The update should install perl 5.20 whereas on my server it's still running perl 5.10.1.

I'll post more news as and when I get it.

[brucet]

Please note: PayPal have postponed enforcement of TLS v1.2 to June 2017 - see https://devblog.paypal.com/upcoming-...es-notice/#tls. As far as we are aware, no payment provider is now planning to enforce the change this year.

Support for TLS v1.2 will still be implemented in SellerDeck 2016 (v16.0.2), however the release has been postponed to July 2016.

[fleetwood]

Not exactly sure if this is related, but as of this evening, the handback from payment gateway back to sellerdeck is not happening on our 1&1 hosted (shared server) website. Checkout hands over to PayPal (where payment is taken), but fails to hand back order details to sellerdeck resulting in Internal Server Error. Checkout via Sellerdeck payments just hangs on an Internal Server Error at final phase prior to hand over to sellerdeck payments.
I am still running version 10.0.2, so not sure if that has any bearing
This seemed to kick in around 5pm this evening. Orders were working fine this morning

[chris ashdown]

Checked with UKFAST their dedicated server all have it

[Mike Hughes]

An update on the situation with 1&1.

I talked to their technical support a couple of weeks ago about when the shared server I'm on was going to be updated and all they could tell me was that it was a rolling update and that all servers would be updated by summer 2017.

Anyway, I just received an email from them saying the server has now been updated. Sellerdeck seems to be running fine, I've placed test orders using both PayPal and Secpay/Paypoint and there's been no problem. Payments have come through, the return to the site has worked, the emails are being sent and the orders are coming through onto the desktop system.

I've also tested the TLS 1.2 requirements for the upcoming PayPal upgrade and this now works fine against the PayPal test server.

Perl on the server is now 5.20.2 which doesn't seem to be a problem.

So all in all it's looking like a good upgrade.

I'm sure I've seen reports from others who have had problems after the upgrade so I'm going to take a look at those and see if there's something I'm not seeing. I'll report back if I find anything new.

[Mike Hughes]

PS. While searching around yesterday I noticed this in the V11 release notes for sellerdeck 11.0.4:

Updated the PayPal integration to support HTTP/1.1 protocol, AC11-3369

As the PayPal updates require both TLS 1.2 and HTTP/1.1 then it would appear that Sellerdeck versions before 11.0.4 will no longer work with PayPal once the PayPal updated security goes live. Currently scheduled for June 2017.

[brucet]

That's correct. We will be making every effort to notify users well ahead of the deadline.

[brucet]

TLS v1.2 Update

SellerDeck Desktop 2016 (v16.0.2), released this week, provides full support for TLS v1.2 on the desktop (support on the website being reliant on the web host).

The implementation necessitated an upgrade to the PHP included with the software. This may affect any plugins or custom code using PHP, so anything like that should be fully tested in Test Mode before going live.

For more details and to download the new release, see http://www.sellerdeck.co.uk/index.ph...merce-software

We do hope to provide a similar upgrade for some versions prior to SellerDeck 2016. I will post an announcement when more information is available.

[Mike Hughes]

Thanks Bruce,

As a quick update I can can confirm that after 3 weeks my sites on 1and1 are still working away happily after the upgrade to the server.

The impression I've got from the posts on the form is that most of reports of problems with 1and1 after the server upgrade seem to be for earlier versions of Sellerdeck. I can't help wondering if the more recent versions of Sellerdeck are likely be using a perl compiler / development tool that ensures compatibility with the more recent versions of perl.

Mike

[brucet]

I don't think we've changed anything like that for a long time. Perl 5.004 had a few issues but I doubt if anybody still uses that. SellerDeck v8 introduced a construct that was not supported in Perl v5.004 and older, but that was fixed in v9.

We did have a problem a few years ago when 1&1 upgraded to a buggy version of Perl, but that was withdrawn and later replaced.

I'm not aware of any issues with recent Perl versions.