Release v31.0.3
Woocommerce Redsys Gateway v31.0.3
What's new in v31.0.3
Woocommerce Redsys Gateway v31.0.3 was released on . Allow customers to check out and pay via RedSys (the Servired / Sermepa successor) on your WooCommerce store. See the full changelog below and compare with the complete version history.
Release details
Released
6.9 MB
File available
Changelog
Fixed
- InSite card payments on the block-based (Blocks) checkout were rejected by Redsys
- InSite card payments on the block-based (Blocks) checkout were rejected with
- InSite card payments on the block-based (Blocks) checkout failed with a
Other
- with SIS0574 ("browserUserAgent not indicated"): the 3DS browser fingerprint never
- reached the order because the hook that copies it (woocommerce_checkout_create_order)
- does not run on the Store API checkout. The InSite Blocks form now collects the
- fingerprint and sends it with the token, and it is written onto the real order before
- process_payment runs.
- an "error code without token" after a few attempts (shown as "check that the
- checkout/card fields are filled in"). Because the order does not exist yet on the
- Blocks checkout (order id 0), the prepared Redsys order number was almost constant
- (~999 possible values, all ending in zeros) and Redsys rejects a reused order number.
- The InSite Blocks form now uses a unique incremental sequence as a surrogate id.
- misleading "check that the checkout/card fields are filled in" error and the order
- was never paid (the browser console showed a 404 on save_order_data). Current
- WooCommerce no longer creates the order until "Place order" is pressed, so during
- card entry the Blocks checkout returns order id 0 and the InSite token (idOper) and
- prepared order number could not be saved to order meta. They are now stashed in the
- WooCommerce session via admin-ajax when the card is tokenised and moved onto the real
- order while it is created (woocommerce_store_api_checkout_update_order_from_request),
- before process_payment runs, and the order-number transient is re-mapped to the real
- order id so the notification (IPN) resolves the order. The classic/shortcode checkout
- is unaffected.
- Security Fix: Added Inespay notification signature (signatureDataReturn / HMAC-SHA256)
- and amount verification in the Inespay callback to prevent unauthenticated payment
- forgery. The signature gate covers both the single-payin and the periodic-mandate
- notifications. Thanks to Shivamani Vastrala for the responsible disclosure.
Compatibility
- Requires WordPress
- 5.4
- Tested up to
- 7.0
- Requires PHP
- 7.4
Verified safe
Woocommerce Redsys Gateway v31.0.3 scanned clean with no security threats detected.
View full scan report