agiliq/merchant — pull request #68 by theju (2013-05-12 10:44:56+00:00)
Title: Prevent CC number from hitting server causing PCI compliance issues

In the Stripe integration, the payment form that is submitted to Stripe is forwarded as is back to the server causing PCI compliance issues.

People use stripe.js to overcome these issues and the server handling it should never see the CC number (last 4 digits is fine).

Another thing is that we are leaking the csrf token while sending the request to stripe. Here is a fix which creates a new form that submits the redacted credit card number, expiration month and year along with the token to the server.