Handling the Temporary Internal Incoming Email Outage on Your ShiftCode GPT Site

Recently I had the chance to organize me thoughts concerning the recent internal incoming email outage affecting ShiftCode GPT sites by responding to a posted question on the ShiftCode Official Facebook Group.

Q:  The main site seems to be down and so is the e-mail client. Can anyone help please? Thank You

A:  Addressing the GPT internal incoming email outage (likely temporary) - the attitude I've taken is that since GPT site domain based internal incoming email doesn't fall into the 'mission critical' category (with me) then I've simply configured my 'From E-mail' in the ShiftCode admin panel (right side menu Main > Configure > E-mail) to a free Gmail based email address.

This assures me that I'll still get system notifications from the GPT script while also providing a viable uninterrupted 'from' email address that's reachable during the temporary email outage (once you've changed this email address field then all of your member email notifications from the system will also appear to be coming from this new email address (it's always been 'spoofing' whatever email address you poke in here))

Don't feel shy about promoting the extra temporary email address because when the built-in domain email service comes back then you can just forward the temp email account messages back to the old domain based email account

If you do decide to just stick with the free email account (Gmail, Hotmail, etc) then know that you're not losing or trading much off here. The email address is just there to provide a viable return message path as a return email address to all your GPT's system messages to the member and to provide you (the admin) with messages from the GPT script as to what's happening on your GPT (notice of withdrawals, inbox messages, etc.)

I'm quite comfortable just using my Gmail based email address for as long as the outage lasts.
Last things to consider might include:

1) notifying your members via a mass email blast (yes, the mass email function still works just fine) of the temporary email outage condition while offering up the new email address for them to white list and use for any and all near future email contact attempts to your GPT administration; and

2) if the email outage persists then slowly make a round to change (or add) the new temp email address to any affiliate network, service provider (ProxStop, etc) and payment processor accounts (PayPal, etc)
____________________

For those who are searching for true alternatives to the built-in domain email provided by ShiftCode then here's is an article that I ran across concerning free options (though I don't know how old the information in the article is still accurate):

What Should I Do Now that Google Apps Accounts Are No Longer Free? [http://lifehacker.com/.../what-should-i-do-now-that... ]

Another option is to use your own domain hosting account for email hosting only (while ShiftCode hosts the actual domain - see the MX records statement below))
If you do choose to use an alternate domain email provider then you will ultimately likely need to contact ShiftCode to make the necessary domain 'MX record' (mail exchange) changes for you (since ShiftCode IS your 'DNS' provider if your name servers are ns1.shiftcode.com, etc. - highly likely)

[Please feel free to inbox me if you're confused or need assistance with any of this (though note I am NOT ShiftCode staff) I'm almost always happy to help freely as my spare time permits]

Secure Your ShiftCode GPT PayPal Email Withdrawal Fields By Making Them Static / Read Only / Non-Editable

Over time there has purportedly been an occasional rash of ShiftCode GPT site member accounts getting hacked (or accessed by unauthorized persons due to improper password hygiene / security practices by members)

NOTE:  If you are a GPT site member then don't worry, it's relatively simple to avoid getting your account hacked by making sure that you use a strong password that you don't use at any other site.  It also may help to minimize risk by not allowing your GPT member account(s) to accrue a large balance - don't leave it in, withdraw it all ASAP.

While these unauthorized persons are accessing the GPT member account many times the main target is to withdraw any standing account balance to PayPal via the withdrawal dialog.

In order for the offender to benefit from the unauthorized withdrawal then they must be able to change the true account holder's PayPal email address that's sometimes on file to the PayPal address they desire.

If the target GPT site doesn't have the security measures I speak of in this article in effect then raiding a hacked GPT site member account is relatively easy if the GPT admin and/or the GPT site member has been even mildly careless.

---

If your ShiftCode GPT site has instant (unattended / automated) withdrawal methods available I highly recommend that you apply this modification to ALL the instant methods you offer (methods other than PayPal may need slight modifications to this very basic code)

---

Here are the changes I recommend.  These changes and code modification have been tested on several GPT sites so far with good results.

PROJECT COMPLEXITY – NOVICE TO INTERMEDIATE
(Probably OK for Newbies or Coding Beginners but if you are squeamish then seek help
or observation by someone who knows a bit better – you may even contact me for help or
observation but I won’t do it completely for you entirely)

If you are the tiniest bit squeamish about altering PHP script code in its raw form then I highly recommend that you hire a programmer to make these changes for you.  Though know that as programming code modifications go, this particular project is super simple for most do-it-yourselfers.

---

1. In your ShiftCode GPT site Admin Panel then go to (left side menu)  Products > Withdraw (click on the word 'Withdraw')
2. Find 'PayPal' (or the desired withdrawal method you wish to secure) and click on it.  You should now be at a screen that says "Methods > Edit Method" at the top.
3. Un-check (if checked) the "Type Again:" box that is described as "Yes, force the user to type their info in twice."
4. Basically what we just accomplished is to make sure that the PayPal email only appears once (and doesn't need to be typed into the second field when withdrawing) on the withdraw page.

Now we'll move on into the actual code editing portion of this project.  Whether you are a beginner or a seasoned pro at this point I must admonish you to make complete backups of any code (the whole file - ALL the code in that file) you intend to change - BEFORE you change anything.

My preferred method for making such backups is to bring up notepad (notepad.exe - the  built in Windows text file editor) and copy all the code in the file you intend to modify to notepad and save it under the name of the script or include file.  Again, do this BEFORE you make any modifications to the code.

Also, at this point I should mention (just to be wise towards the future) that ShiftCode has a built in function that will conveniently zip up all of your script files and then make a single zip file containing all of the current states of your script files (at least the ones you have access to - there are many more scripts behind the ShiftCode 'curtain' that you can not see) available for you to download and file away in a safe place on your own machine for future reference.

There is no time like the present to do this.   To download your scripts backup the simply click on 'Scripts" under 'Files & Templates' in the lower right menu in your admin panel.  Then look in the upper right area of the center window (at the top) for a button labeled 'Backup All' (as seen below) and click on it to download the script backup file.  Store it in a safe place that you will remember when/if you need it.

Ok, back to our little coding project.

1. Find and click on 'Includes' (above where you found 'Scripts' above) under the 'Files & Templates' heading lower down on the right side Admin Panel menu.  Click on 'Includes'.
2. Find the include with the ID '_withdraw_form' and click on it to reveal the 'Editing Include' page for that include.
3. This is the point where I usually STOP COLD and copy all the code in the window and paste it into notepad and save it to a text file just in case.
4. NOTE: See [skip to] the “UPDATE: [10/08/2014]” statement below INSTEAD of steps 4 and 5 below now if this is your first time attempting this modification (the update contains newer information just discovered)
   
5. 
   
   
   ________________________________________________________
   UPDATE: [10/08/2014]  REPLACING STEPS 4 AND 5 ABOVE !
   
   Ok, I just ran across a GPT admin with a slightly different configuration (his site was heavily customized already) anyways what I learned was that in certain cases it DOES matter exactly where you put the “ readonly “ statement and actually that statement belongs rightly just after the “input” statement in that line of code.
   
   So in the below statements the first statement is what the original looks like and the second statement is what it should be changed to INSTEAD of the above way (left in for the sake of those who have already completed the change that way – if you already changed it the above way and it works then it’s fine to leave it that way but if you are making this as a new change then use the below examples INSTEAD OF the above examples:
   
   
   Change that (above) to (notice the “ readonly “ with a space before and after just AFTER the “input”
   ________________________________________________________________
   
6. Save that code change by clicking on the 'Update' button at the bottom.
7. Now log in to your GPT site as a member (with enough funds to see the withdrawal option) and notice that now you can not change the Paypal email field from the default pre-set Paypal email address.   DONE!

---

Ok, there are still certain conditions where if your site was not set up with the configuration that I predicted (and would be normal) like using a custom field for the PayPal email address that was completed during registration.

You’ve marked that custom field read-only (simple setting) for them not to be able to change after registration.  And the fact that once you have completed the above modification then you will want to remind your members somewhere that if/when ever they need to change their pre-set PayPal withdrawal email then they will need to contact you (the admin) to do it for them via inbox message or support ticket (ONLY)  You won’t want to allow PayPal email address change requests to come in from the built-in ShiftCode contact form, or even via direct email – you want this crucial contact to be made ONLY from within the member’s account for security purposes (the contact form can be accessed from outside the account and any email can be spoofed by anyone making it look that it’s coming from anyone!)

Remember, if hackers are smart enough to guess people’s passwords then they are probably also smart enough to try and trick you (the admin) into making the email change for the targeted account for them (wink)

---

Also (without going into too many details publicly here) if your site has instant payment methods then it is highly recommended that you DO NOT use the 'Signature' referral banners feature (the banners that show individual member stats on them)

---

There you go ;-)