search

DrupalSecurityTeam / drupalpcicompliance

Official github repo for the Drupal PCI compliance white paper.
http://drupalpcicompliance.org
Other
57 stars 15 forks source link

Paypal merchant-managed service mistake #37

Open emsearcy opened 9 years ago

emsearcy commented 9 years ago

Paypal Payments Standard is listed as both a Hosted Payment Page and a Merchant-Managed method. I believe the Paypal merchant-managed method should be "Paypal Payments Pro", as Standard is only a HPP.

rickmanelius commented 9 years ago

Hi @emsearcy. I'll update this to correct the discrepancy https://github.com/rickmanelius/drupalpcicompliance/blob/master/DrupalPCICompliance.md#merchant-managed

greggles commented 1 year ago

Restating the original proposal here:

  1. Merchant-managed example would change from "PayPal Payments Standard (PPS)" to say "PayPal Payments Pro"
  2. Example HPP solutions would stay as it is.

From this doc page about Paypal Payments Pro so it seems it can be either a "merchant managed" or a "direct post" solution. We could leave it in both places and note the use of

Use the optional Transparent Redirect feature, which helps merchants be PCI compliant. With Transparent Redirect, the buyer enters credit card information on a web form that you host, but payment details are posted silently to the PayPal server when the buyer presses submit, so the credit card details never go through your server.

So I propose a slightly different solution:

  1. Merchant-managed example would change from "PayPal Payments Standard (PPS)" to say "PayPal Payments Pro"
  2. Example HPP solutions would stay the same
  3. Example Direct Post solutions would get a new line "Paypal Payments Pro with Transparent Redirect"

Any thoughts on that @emsearcy or @rickmanelius?