Mediachase ASP.NET eCommerce Framework - Paddy O's Corner - Tips, Tricks, and Tools : Tutorials & Guides

Guide to Payment Card Industry (PCI) Compliance

richlyc — Wed, 05 Mar 2008 00:06:00 GMT

A much talked about item in the commerce space is PCI compliance. It also seems to be a point of confusion for a lot of people depending on how educated you are on the subject.

A Quick Background

First things first--the problem is simply that over the last few years there has been a lot of effort by retailers, banks, service providers, and credit card companies to protect their customers and instill confidence in online retail. As a result the PCI standard was born from the original Mastercard and Visa SDP (Site Data Protection) plan, Cardholder Information Security Plan (CISP), and the International Account Information Security (AIS) standard. Then in September 2006, five of the big guys, American Express, Discover, JCB, Mastercard Worldwide, and Visa International formed the PCI council and released V1.1 of the PCI Data Security Standard (PCI DSS).

The PCI Standard

This standard is universally known and has a key focus on six categorical requirements with a collection of 12 distinct requirements across those categories.

Here they are:

Build and Maintain a Secure Network
- 1. Install and maintain a firewall configuration to protect cardholder data
- 2. Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data
- 3. Protect stored cardholder data
- 4. Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program
- 5. Use and regularly update anti-virus software
- 6. Develop and maintain secure systems and applications
Implement Strong Access Control Measures
- 7. Restrict access to cardholder data by business need-to-know
- 8. Assign a unique ID to each person with computer access
- 9. Restrict physical access to cardholder data
Regularly Monitor and Test Networks
- 10. Track and monitor all access to network resources and cardholder data
- 11. Regularly test security systems and processes
Maintain an Information Security Policy
- 12. Maintain a policy that addresses information security

Is Your Product Compliant?

Wrong Question!

Our ECF commerce framework is simply an application that enables compliance and fits into an overall strategy that your company follows for compliance. By default we protect stored cardholder data and enable encryption of cardholder data appropriately. However, if you choose to not adhere to the PCI standard and decide to implement the ECF differently, then guess what? You have violated a part of the PCI standard. It is that simple. Meaning: it's your strategy and responsibility to adhere to PCI DSS.

People call and ask us if we are compliant and we always have to explain that compliance is a matter of adhering to the standard which is clearly outlined.

The Correct Question: How are we going to ensure that we are fully PCI compliant as an organization?

It Can't Be that Simple?

Its not. Like everything in life, if you want to do it right you have to think it through and ensure that you are doing everything in a way that ensures the standard is met. In addition, there are levels and qualifications required on an annual and quarterly basis also outlined in the standard.

Ok, I Get It. How do I find out More?

There are all sorts of sources on this subject and there are a lot of other companies that specialize in helping your organization hit the mark. One company we like is the folks at Qualys who have a great background in this and other matters. If you want a great starting point head on over to http://www.qualys.com/products/pci/qgpci/.

They also have a great whitepaper you can register and download called "Winning the PCI Compliance Battle," located at http://www.qualys.com/events/guides_wp/.

Go get 'em!

Payment Gateways in the ECF

tim5 — Thu, 30 Nov 2006 01:48:00 GMT

Introduction

Payment Gateways are essential to any E-Commerce Solution, however, they can also be some of the most complex components to implement. This is due to the fact that each payment gateway requires a slightly different set up and different parameters and thus requires a different configuration.

With this in mind, I have undertaken the work of putting together a quick and easy crash course on payment gateways and their relationship with the E-Commerce Framework. It is my hope that this will help developers get off on the right foot when implementing their various gateways and avoid some possible pitfalls.

Overview

This document deals with the following aspects of Payment Gateways:

What is a Payment Gateway?
How Payment Gateways work
How Payment Gateways operate in the E-Commerce Framework
Implementation Examples of Built-in ECF Payment Gateways
Custom Payment Gateways

Download

The document is in .pdf form and can be downloaded by clicking the link below.

Understanding MasterTemplates

tim5 — Fri, 13 Oct 2006 00:52:00 GMT

Introduction

The idea of Master Templates is central to the e-Commerce Framework. Every site developed with the ECF should begin with the development of a Master Template. Each Master Template is broken up into the following parts:

Master Page File (MasterPage.master) -- which defines site layout
Product Templates (.ascx controls) -- define product page layout
Category Templates (.ascx controls) -- define category page layout
.ECF file -- sets site schema
Modules -- modules registered and used on Master Page
Theme -- .CSS files, .Skin files, and images (site formatting)

The attached document will define and describe each of the above 6 sections in detail and finish by giving the reader step-by-step instruction on the Master Template installation process.

Download

The document is in .pdf format and can be downloaded by clicking on the link below.

Creating a theme in the ECF

tim5 — Mon, 09 Oct 2006 07:41:00 GMT

Introduction

A site theme is an important part of any web site. A well-formatted web site will have a consistent theme throughout. Theme constitency signals good organization to the user and serves to ensure he/she that they are still on the same site.

Three simple steps are involved in creating a theme for your ECF site: 1) create your theme folder, 2) create your images, .css, and skin files and 3) specify your theme in the public store web.config.

This is all explained in the the following short tutorial available for download.

Download

The file is compressed and includes documentation in .pdf format as well as a theme folder to be copied in your publicStore app_themes directory. To download click the link below.

Article on Order Process with Protx Payment Gateway

tim5 — Mon, 02 Oct 2006 22:38:00 GMT

Introduction

Attached you will find an article entitled, "Order Processing Options" which details 3 order processes using Mediachase and the Protx payment gateway. These are:

1. Standard Order Process

2. Defer and Release Order Process

3. Authorize and Repeat Bill Order Process

This document was authored and submitted to Mediachase by David Laing of Lucid Communications (www.lucidcommunications.co.uk). Lucid Communications is a communications consultancy based in London. Working across a wide range of media, they provide workforce training and communications, corporate communications, marketing communications, public awareness campaigns, and information management.

Author: David Laing, Software Developer

Company: Lucid Communications www.lucidcommunications.co.uk

For Beginners: Creating a new page in the ECF

tim5 — Fri, 29 Sep 2006 00:54:00 GMT

Inroduction

This 3-page article quickly demonstrates how to add a new page in a store created using the ECF 4.0.

Overview

In this article the user will learn how easy it is to create a new page in the ECF. They will also be introduced to the concept of a master page.

Download

The file is attached for download with the link provided below and is in .pdf format.

Single sign-on in the E-Commerce Framework

tim5 — Wed, 27 Sep 2006 23:09:00 GMT

Introduction

The aim of this tutorial is to help the user become familiar with the concept of single sign-on within the ECF using forms authentication. The article is coupled with a small sample single sign-on application. By reading the article and reviewing the code, you will be on your way to enabling your site(s) to make use of single sign-on.

Overview

In this article you will:

Learn how the basics of single sign-on in relation to the ECF.
Be able to examine sample code to see a simple working example of the ideas set forth in this tutorial

Download

To download simply click on the attachment below this message. The file is in .zip format and contains a .pdf document as well as a small sample single sign-on application.

Images in the e-Commerce Framework 4.0

tim5 — Wed, 27 Sep 2006 22:41:00 GMT

Introduction

Images can give a lasting impression to a visitor of a web site. So, it is fitting that images have been a hot topic in support. Most questions are basic in nature and come from new users of the ECF. This tutorial on images is directed at that audience, in order to get those new to the eCommerce Framework more comfortable with handling images in the creation of their site. If you have been using the ECF for some time, do not let the nature of this article deter you, you still may be able to gain insight by reading or even browsing the article. Increase your efficiency, download this article by clicking the downloads link below.

Overview

In this article you will:

Learn how theme images are displayed.
Learn how product/category images are displayed
Learn how to mass import product/category images.
Learn how the ThemedImageButton/ThemedImage module resolve image urls.

Download

To download simply click on the attachment below this message. The file is in .pdf format.

Setting up and compiling the fullsource ECF using existing trial workstation

tim5 — Mon, 11 Sep 2006 22:38:00 GMT

Intro

We've had a few people complain of a particular error when installing and implementing the full source code version of the e-Commerce Framework. The error goes something like this: the directory '/publicstore/app_globalresources is not allowed because the application is precompiled'. Nine times out of ten when an error makes mention of a pre-compilation issue this is because .cs files or .resx files have been included in a deployment version of the software.

Overview

Most of you already know that Visual Studio compiles your C# code (and all other langauges supported by VS) into intermediate language (IL), this can be turned into native machine code to be executed by the Common Language Runtime (CLR).

The first compliation step when the code is turned into IL can be done when the page is first requested or it can be performed in advance. When it is compiled in advance into IL this is called "precompiled" code. The compiled file is now called an assembly.

The problem

A common mistake when upgrading from the distribution to fullsource code is to simply copy the fullsource version over the distribution while retaining the settings in the web.config files. There is one critical problem here: In the distribution, source files and .resx files are already in a precompiled state. This means they are in assemblies (IL code). When you bring your .cs or .resx files into this environment the compiler gets confused beacause it sees the .cs and .resx files and realizes that it needs to compile these into cache. Which it will do, but now you have two sources for your code: cache and your IL code and this causes the error(s).

An example: The App_GlobalResources error

I mentioned this error at the start of the article and I just want to briefly go over it here since this is the error that most commonly arises when dealing with a fullsource upgrade and is also a good example of the problem illustrated above.

In the fullsource version of ECF you will notice a directory that is not included in the distribution: It is the App_GlobalResources directory within the PublicStore. This directory contains the .resx files in the eCommerce Framework which are used primarily for localization. .resx files are still in a raw state meaning they are not compiled or even pre-compiled yet. This is the reason they are not in the distribution, because the distribution contains no source or .resx files since the files in the distribution are already precompiled in advance. When you include .resx files inside the public store, which would happen if you simply copy the full source over the distribution, you will have the same situation described above: .resx files existing simutaneously with its own code in a precomplied state which will frustrate the CLR when attempting to access a page.

The solution:

To install the eCommerce Framework fullsource while already having the distribution on your computer it would be easiest to simply take these easy steps:

1) Unzip the fullsource code to its own directory separate from the distribution. This will avoid the problem of copying source files into the distribution where they will generate errors.

2) Copy your distribution web.configs (public store, commerce manager, web services) over the web.configs of the fullsource version. This will preserve your connections.

3) Open up the solution files for the front-end and back-end and build your solution.

Roles in the eCommerce Framework

tim5 — Wed, 06 Sep 2006 18:15:00 GMT

Introduction

Applying Roles for users and customers has been a question that many of the users of the eCommerce framework have asked. The attached article is aimed at answering those questions. In it you will learn how to apply and assign roles both in the front-end and back-end of the eCommerce Framework.

Download

To download simply click on the attachment below this message. The file is in .pdf format.

How to send Email Confirmations/Notifications

tim5 — Wed, 23 Aug 2006 18:31:00 GMT

Introduction

The ability to send confirmation email notifications to customers is critical to any store. The e-Commerce Framework comes with a built-in service to take care of this. The attached .pdf details the quick and easy steps to set this service up.

Overview

In this guide you will see how the email notifications work and how to set them up immediately.

Download

To download simply click on the attachment below this message. The file is in .pdf format.

Importing Data: The import manager in Commerce Manager

tim5 — Wed, 23 Aug 2006 15:25:00 GMT

Introduction

Importing has been a common concern, for obvious reasons, amongst developers using the e-Commerce Framework. The following guide describes, in basic terms, how the import process can be accomplished via the import manager in the e-Commerce Framework.

Overview

In this article you will:

Be introduced or re-introduced to the import manager.
See an example of importing a simple data file.
Learn how the import manager generates a mapping file.
View an example of the structure of a common mapping file.
Learn how to import using existing mapping files and data files.

Download

To download simply click on the attachment below this message. The file is in .pdf format.

SSL and the e-Commerce Framework

tim5 — Mon, 14 Aug 2006 19:36:00 GMT

Introduction

This is a quick, straight to the point article in order to give you insight on how to go about creating secure web pages in the e-Commerce Framework. By reading this 3-page article you will find out what it takes to make your site secure and be surprised at just out simple it is.

Overview

The aim of the article is to get you up and running as quickly as possible in your quest to create a secure site. It will be helpful to open your PublicStore web.config file during the reading of this acticle and scroll down to the sections described.

Download

To download simply click on the attachment below this message. The file is in .pdf format.

Understanding the Meta Data Plus Engine

tim5 — Fri, 04 Aug 2006 23:19:00 GMT

Introduction

The Meta Data Plus Engine (MDP) is the underlying engine for all the key components of the eCF. It is an integral and fundamental part of the eCF and should be understood at least on a basic level . The attached article will aid the new user/developer of the eCF 4.0 to become familiar with the MDP. Seasoned eCF users are encouraged to read it as well.

Overview

In this article you will:

Understand what the Meta Data Engine is.
You will see a pratical application of how to use the MDP engine.
In the process you will see how to create your own Product Class and Sku Class.
Also, you will see how to add attributes to these new classes.
Understand the purpose of .eCF file, how it is built and how it relates to meta-classes.

Download

To download simply click on the attachment below this message. The file is in .pdf format.

How to manage Taxes in the eCF 4.0

tim5 — Fri, 04 Aug 2006 23:05:00 GMT

Introduction

Taxes are a concern of anyone who is trying to manage their own online business. With this issue in mind, I have decided to post a quick tutorial in order to get you familiar with the tax management process in eCF.

Overview

This article is targeted a general users of the eCF 4.0, however developers may find some value in reading the information therein. This document on tax management is an exerpt from the Mediachase Commerce Manager Operations and Administration guide. Please check it out as well to gain more insight into the features of the Commerce Manager, it serves as a reference for key backend functions including customer, order, catalog, configuration, and other key business functions.

Download

To download simply click on the attachment below this message. The file is zipped and is in .pdf format.