Details
-
Type: Security Advisory
-
Status: Done/Fixed
-
Priority: Major
-
Resolution: Duplicate
-
Affects Version/s: 4.6.19, 4.7.9
-
Fix Version/s: None
-
Component/s: CiviCRM API
-
Labels:
-
Documentation Required?:None
-
Funding Source:Needs Funding
Description
While using Webforms with Drupal 7, CiviCRM 4.6.x, and Authorize.Net, I noticed that bad transactions are being dumped into the watchdog log. The Credit Card data is listed unencrypted and well labeled.
Specifically this error occurred when a transaction was matched to a donor who was in the trash.
Array ( [credit_card_number] => 12345678913 [cvv2] => 231
[credit_card_type] => Credit Card [billing_first_name] => John [first_name] => John [billing_last_name] => Doe [last_name] => Doe [billing_street_address-5] => 123 11th Street NW [street_address] => 123 11th Street NW [billing_city-5] => Smallville [city] => Smallville [billing_country_id-5] => 1228 [country_id] => 1228 [billing_state_province_id-5] => 1040 [state_province_id] => 1040 [billing_postal_code-5] => 50010 [postal_code] => 50010 [year] => 2018 [month] => 3 [email] => john@gmail.com [contribution_page_id] => 2 [is_test] => 0 [payment_processor_id] => 1 [financial_type_id] => 2 [currencyID] => USD [currency] => USD [skipLineItem] => 1 [skipRecentView] => 1 [contact_id] => 14 [total_amount] => 100 [invoice_id] => 812345646548797986554321f [description] => Webform Payment: Join US! [source] => Register [submitted] => Array ( [contribution_pagebreak] => Payment [civicrm_1_contribution_1_contribution_payment_processor_id] => 1 [civicrm_1_contribution_1_contribution_contribution_page_id] => 2 ) [hidden_processor] => 1 [credit_card_exp_date] => Array ( [M] => 3 [Y] => 2018 ) [billing_middle_name] => [details] => Array ( [sid] => [page_num] => 4 [page_count] => 4 [finished] => 0 ) [form_build_id] => form-ZaHJ465465465468/84sdfd6UC4tk [form_id] => webform_client_form_1074 [op] => Submit [check_permissions] => [version] => 3