Drupal / Ubercart says it's not saving CC data... then what's "_save_cc_data_to_order"?

Question

I'm using Drupal 6, Ubercart 6.x-2.4, and the Stripe payment module.

I wanted to double-check my PCI compliance and make sure I'm not storing credit card data in my database, but I looked at my database and found encrypted CC data in the uc_orders table.

In modules/ubercart/payment/uc_credit/uc_credit.module there is a method called _save_cc_data_to_order. If I comment out this method's contents, the orders still go through my test gateway but the database is no longer populated with cc data.

Hacking up ubercart module code is an effective way to stop from saving cc data in my database, but I didn't think this should be necessary.

What is going on? I have debug mode off in admin/store/settings/payment. I don't understand why it would save ANY cc data--I don't need persisted users and turned anonymous checkout on intentionally.

Answer 1

_save_cc_data_to_order() is called from 3 places:

• uc_credit_order()'s Save operation. When Debug mode (uc_credit_debug) is on, it saves the full payment details. When Debug mode is off, it saves the last 4 digits of the credit card number (and all other payment details except the CVV).
• uc_credit_order()'s Submit operation. When Debug mode is on, it saves the full payment details. When Debug mode is off, it's never called.
• uc_credit_terminal_form_submit(). When Debug mode is on, it saves the full payment details. When Debug mode is off, it's never called.

So, under normal circumstances (when Debug mode is off), Ubercart is storing some sanitized information. I can't speak to whether this meets your level of PCI compliance requirements, but this answer might be helpful.