a1dert/lh-tickets-test — Issue #332: Credit Card data not ecrypted on POST
Author: a1dert
Created: 2011-11-30 12:06:47+00:00
State: open

Imported from lighthouse. Original ticket at: http://redtape.lighthouseapp.com/projects/59696/tickets/262. Created by Adina Moldovan - 2011-05-31T10:04:23Z

Steps:
1. Register into the application
2. Monitor the POSTs in the application

Expected: the credit card data is encrypted from browser (cc number, expiration date, validation number)
Actual: I can see (with Fiddler) all the credit card data without any encryption.

Note! This can be observed also on changing the credit card number from Settings

Register token:
>utf8=%E2%9C%93&authenticity_token=aaTCezhD%2By%2B692yFn8vNcvz91j%2BknZm8grh9Ov6aw1w%3D&company%5Bstep%5D=payment_details&company%5Baddress_attributes%5D%5Baddress1%5D=test6&company%5Baddress_attributes%5D%5Baddress2%5D=&company%5Baddress_attributes%5D%5Bcity%5D=test6&company%5Baddress_attributes%5D%5Bstate%5D=&company%5Baddress_attributes%5D%5Bpostal_code%5D=1223456&company%5Baddress_attributes%5D%5Bcountry_code%5D=AF&company%5Bpayment_profile_attributes%5D%5Bcard_type%5D=visa&company%5Bpayment_profile_attributes%5D%5Bcard_number%5D=4872935806998716&company%5Bpayment_profile_attributes%5D%5Bcard_expires_on%283i%29%5D=1&company%5Bpayment_profile_attributes%5D%5Bcard_expires_on%282i%29%5D=5&company%5Bpayment_profile_attributes%5D%5Bcard_expires_on%281i%29%5D=2011&company%5Bpayment_profile_attributes%5D%5Bverification_number%5D=123&commit=Create+my+account

Change CC token
>utf8=%E2%9C%93&_method=put&authenticity_token=3yMvwUH5J1MbbKetjl%2B3WiHnKeTnTDlSH2RTbPzyDSc%3D&payment_profile%5Bcard_type%5D=visa&payment_profile%5Bcard_number%5D=4769624952552685&payment_profile%5Bcard_expires_on%283i%29%5D=1&payment_profile%5Bcard_expires_on%282i%29%5D=5&payment_profile%5Bcard_expires_on%281i%29%5D=2011&payment_profile%5Bverification_number%5D=123&commit=Save+changes