Drupal / Ubercart says it's not saving CC data... then what's "_save_cc_data_to_order"?

Question

I'm using Drupal 6, Ubercart 6.x-2.4, and the Stripe payment module.

I wanted to double-check my PCI compliance and make sure I'm not storing credit card data in my database, but I looked at my database and found encrypted CC data in the uc_orders table.

In modules/ubercart/payment/uc_credit/uc_credit.module there is a method called _save_cc_data_to_order. If I comment out this method's contents, the orders still go through my test gateway but the database is no longer populated with cc data.

Hacking up ubercart module code is an effective way to stop from saving cc data in my database, but I didn't think this should be necessary.

What is going on? I have debug mode off in admin/store/settings/payment. I don't understand why it would save ANY cc data--I don't need persisted users and turned anonymous checkout on intentionally.

Answer 1

_save_cc_data_to_order() is called from 3 places:

• uc_credit_order()'s Save operation. When Debug mode (uc_credit_debug) is on, it saves the full payment details. When Debug mode is off, it saves the last 4 digits of the credit card number (and all other payment details except the CVV).
• uc_credit_order()'s Submit operation. When Debug mode is on, it saves the full payment details. When Debug mode is off, it's never called.
• uc_credit_terminal_form_submit(). When Debug mode is on, it saves the full payment details. When Debug mode is off, it's never called.

So, under normal circumstances (when Debug mode is off), Ubercart is storing some sanitized information. I can't speak to whether this meets your level of PCI compliance requirements, but this answer might be helpful.

Answer 2

To reassure yourself that CC data is NOT being saved to your database in the Drupal / Ubercart setup, modify modules/ubercart/payment/uc_credit/uc_credit.module and comment out the contents of the function _save_cc_data_to_order.

You can verify this works by monitoring the data column of your uc_orders table in the database, or by viewing the order using the admin screens. After making the change, no CC data, not even last 4, will be saved to the database.