Release v32.2.0
Woocommerce Redsys Gateway v32.2.0
What's new in v32.2.0
Woocommerce Redsys Gateway v32.2.0 was released on . Allow customers to check out and pay via RedSys (the Servired / Sermepa successor) on your WooCommerce store. See the full changelog below and compare with the complete version history.
Release details
Released
8.0 MB
File available
Changelog
Fixed
- ACP (off by default): with ACP on, WordPress could log "Translation loading for the woocommerce
- Duplicated scheduled actions left by earlier versions are now removed on their own: the paired
- The plugin's text domain is now its slug, woocommerce-gateway-redsys (it was woocommerce-redsys).
- Three strings used WooCommerce's text domain and four order-status counters had none.
- Subscription renewals sent no description to Redsys (empty description in the TPV). They now send
- Paying at checkout with a saved card (redirect gateway) always sent "Order N" as the description,
- (security): UCP MCP (off by default): lookup_catalog takes at most 50 products and no tool returns
- (security): UCP MCP (off by default) now writes every agent tool call to an audit log (client, tool,
- (security): UCP MCP (off by default) now checks a per-address budget before authentication (300 calls
- (security): UCP MCP (off by default) now limits each agent client to 60 tool calls per minute, 600
- ACP (off by default): the public ACP document no longer announces a 60 requests/minute limit that
- (security): ACP (off by default): the "HTTPS required" check believed X-Forwarded-Proto from anyone.
- (security): UCP OAuth (off by default): authorization codes are now stored hashed, like tokens.
- (security): A2A (off by default): after card authentication the shopper could be sent to any
- (security): UCP MCP (off by default): when a tool failed inside the store, the agent received the
- (security): UCP OAuth (off by default): two token requests sent at the same time with the same
- (security): Inespay: after checking the notification's signature, the plugin still let unsigned
- (security): Apple Pay and Google Pay marked the order paid without checking that the amount Redsys
- UCP OAuth (off by default): two refreshes sent at the same time with the same refresh token could
- (security): A2A (off by default): when an operation failed inside the store, the agent received the
Other
- domain was triggered too early" when the hourly ACP clean-up was first scheduled. It is now scheduled
- on init.
- redsys_acp_process_webhooks / redsys_ucp_process_webhooks workers, a redsys_check_emails_cron with no
- group, and repeated daily clean-ups. Since 32.1.0 no new ones were created, but existing ones stayed.
- Custom translation files saved under the old name keep working; translations stored in the database
- by a multilingual plugin and code that filters gettext by the old domain need the new name.
- the description chosen in the gateway settings, as first payments do.
- whatever the gateway setting said.
- more than 1 MB (both adjustable with filters).
- result; arguments only as a fingerprint and a masked summary), kept for 90 days.
- per minute by default) and takes at most 20 calls per batch request.
- per hour and 5000 per day (adjustable with the redsys_ucp_mcp_rate_limits filter).
- BEHAVIOUR CHANGE (security): UCP MCP (off by default): tool arguments are checked against each tool's
- published input schema before the tool runs; calls that do not match get a -32602 error.
- was never applied.
- BEHAVIOUR CHANGE (security): UCP (off by default): Dynamic Client Registration is now off by default and
- switched off once on update. If your agents register themselves, turn "Allow Dynamic Client
- Registration" back on in the UCP settings.
- It now does only from the proxies in the "Trusted proxies" setting (A2A > Status); behind a proxy that
- ends HTTPS, list its addresses there after updating.
- BEHAVIOUR CHANGE (security): UCP OAuth (off by default) accepts only the S256 PKCE method; "plain" is
- refused unless the redsys_ucp_allow_pkce_plain filter allows it.
- BEHAVIOUR CHANGE (security): UCP OAuth (off by default): the token introspection endpoint answered
- anyone. It now requires the calling client's credentials and only reports on that client's own tokens.
- address the agent gave, including plain http or internal ones. Only https addresses on public hosts
- are used now; otherwise the shopper lands on the order page.
- internal error text (which can include server paths). It now receives a correlation id; the detail is
- written to the plugin log.
- BEHAVIOUR CHANGE (security): UCP and A2A (off by default) no longer accept the access token in the URL
- (?access_token=), where it ends up in server logs; send it in the Authorization header. The
- redsys_allow_bearer_in_query_string filter restores the old behaviour.
- authorization code could both succeed. The code is now redeemed atomically; only one gets tokens.
- fields of the request fill in values the signed data did not carry (such as the payment id). Only the
- signed data is used now.
- charged matched the order total, as card and Bizum payments already do. A different amount now puts
- the order on hold with a note, for you to review.
- both obtain a new token pair. The refresh token is now spent atomically; the second gets invalid_grant.
- internal error text (which can include server paths). It now receive
Compatibility
- Requires WordPress
- 5.4
- Tested up to
- 7.1
- Requires PHP
- 7.4
- Requires WooCommerce
- 7.4
- WooCommerce tested
- 11.2
Verified safe
Woocommerce Redsys Gateway v32.2.0 scanned clean with no security threats detected.
View full scan report