I'm using Drupal 6, Ubercart 6.x-2.4, and the Stripe payment module.
I wanted to double-check my PCI compliance and make sure I'm not storing credit card data in my database, but I looked at my database and found encrypted CC data in the uc_orders
table.
In modules/ubercart/payment/uc_credit/uc_credit.module
there is a method called _save_cc_data_to_order
. If I comment out this method's contents, the orders still go through my test gateway but the database is no longer populated with cc data.
Hacking up ubercart module code is an effective way to stop from saving cc data in my database, but I didn't think this should be necessary.
What is going on? I have debug mode off in admin/store/settings/payment. I don't understand why it would save ANY cc data--I don't need persisted users and turned anonymous checkout on intentionally.