Clean CC sensible data on Gold subscriptions #4291
Conversation
| @@ -123,8 +123,14 @@ function PaymentView (config) { | |||
| } | |||
|
|
|||
| PaymentView.prototype.submit_form = function (card_digits, token) { | |||
| this.form.find('#id_card_digits').val(card_digits); | |||
| this.form.find('#id_last_4_digits').val(card_digits); | |||
There was a problem hiding this comment.
This id form specific and shouldn't be changed unless all the forms match. At least one form is using #id_card_digits as the id, and it appears each of the classes extending the base prototype specify fields to match what is used locally. I suppose before this change is made, we need to know why this is #id_card_digits on the base class.
There was a problem hiding this comment.
I grepped all the repositories and I didn't find any place where this ID is used. I suppose it's an old value.
~/rtfd/code ⌚ 14:59:31
$ rg id_card_digits
readthedocs.org/readthedocs/payments/static-src/payments/js/base.js
126: this.form.find('#id_card_digits').val(card_digits);
Link to the query https://github.com/search?q=org%3Artfd+id_card_digits&type=Code
It seems we are safe by modifying the ID in the base class.
There was a problem hiding this comment.
I believe this comes from a form field named card_digits, not explicit html markup.
humitos
force-pushed
the
humitos/stripe/blank-data
branch
2 times, most recently
from
77e7ee9 to
c932ba2
Compare
`PaymentView.submit_form` function removes all CC sensible data. This function is used for `GoldView` in this repo and also for `DonateView` in -ext repo. Since the behavior is shared across them, it's better to modify the parent's function and remove the override from the children.
Use `last_4_card_digits` to avoid confusion and express exactly what it contains.
humitos
force-pushed
the
humitos/stripe/blank-data
branch
from
c932ba2 to
110ca42
Compare
PaymentView.submit_formfunction removes all CC sensible data.This function is used for
GoldViewin this repo and also forDonateViewin -ext repo.Since the behavior is shared across them, it's better to modify the
parent's function and remove the override from the children.
Just to be clear here: we completely ignore this information in our servers. We do not read it or save it anywhere.