14 versions
Woocommerce Redsys Gateway history.
Every release of Woocommerce Redsys Gateway is archived here with its changelog, file size, and security scan result. Use the archive to roll back to a stable release or audit what changed between updates.
14 of 14 releases scanned clean
v31.0.5Latest
July 2, 20267.8 MBScanned
Fixed
- Subscription renewals could still get stuck in an endless SIS0051 ("número de
Other
- pedido repetido") loop after 31.0.4: Redsys reports a duplicate order number as a
- plain errorCode (not as a signed decline), so the stored number was never released
- and every retry resent the same DS_MERCHANT_ORDER. Renewal charges now ALWAYS
- generate a brand-new order number at the start of every attempt and never read a
- previously stored one. The attempt's iniciaPeticion/trataPeticion pair shares the
- fresh number, duplicate concurrent workers are stopped by the renewal lock, and the
- last number sent is still persisted so refunds and the IPN resolve the right order.
- Stores stuck in the loop self-heal on the next scheduled retry after updating.
June 27, 20266.9 MBScanned
Fixed
- InSite card payments on the block-based (Blocks) checkout were rejected by Redsys
- InSite card payments on the block-based (Blocks) checkout were rejected with
- InSite card payments on the block-based (Blocks) checkout failed with a
Other
- with SIS0574 ("browserUserAgent not indicated"): the 3DS browser fingerprint never
- reached the order because the hook that copies it (woocommerce_checkout_create_order)
- does not run on the Store API checkout. The InSite Blocks form now collects the
- fingerprint and sends it with the token, and it is written onto the real order before
- process_payment runs.
- an "error code without token" after a few attempts (shown as "check that the
- checkout/card fields are filled in"). Because the order does not exist yet on the
- Blocks checkout (order id 0), the prepared Redsys order number was almost constant
- (~999 possible values, all ending in zeros) and Redsys rejects a reused order number.
- The InSite Blocks form now uses a unique incremental sequence as a surrogate id.
- misleading "check that the checkout/card fields are filled in" error and the order
- was never paid (the browser console showed a 404 on save_order_data). Current
- WooCommerce no longer creates the order until "Place order" is pressed, so during
- card entry the Blocks checkout returns order id 0 and the InSite token (idOper) and
- prepared order number could not be saved to order meta. They are now stashed in the
- WooCommerce session via admin-ajax when the card is tokenised and moved onto the real
- order while it is created (woocommerce_store_api_checkout_update_order_from_request),
- before process_payment runs, and the order-number transient is re-mapped to the real
- order id so the notification (IPN) resolves the order. The classic/shortcode checkout
- is unaffected.
- Security Fix: Added Inespay notification signature (signatureDataReturn / HMAC-SHA256)
- and amount verification in the Inespay callback to prevent unauthenticated payment
- forgery. The signature gate covers both the single-payin and the periodic-mandate
- notifications. Thanks to Shivamani Vastrala for the responsible disclosure.
June 16, 20266.9 MBScanned
Improved
- La sección "Comportamientos hacia la APP" (conexión con la app
- El filtro redsys_modify_data_to_send ahora recibe
- Actualizadas todas las traducciones.
Other
- Redsys Manager) se oculta de los ajustes de Redsys Avanzado mientras la
- app sigue en desarrollo. La API REST y sus gestores se mantienen; solo se
- elimina el enlace del menú de ajustes.
- 'context' => 'add_payment_method' y 'user_id' en el flujo de "Añadir
- método de pago", para poder enrutar la tokenización al terminal correcto.
- rechazado por Redsys con error de divisa. Ahora se envía la divisa base
- de la tienda, que coincide con el terminal por defecto.
- se creaba como 'C' (one-click) en Redsys. Ahora se envía correctamente
- DS_MERCHANT_COF_TYPE 'R'.
- suscripción no respetaban la preautorización. Ahora se envía una
- preautorización real de tipo 1 que puede confirmarse después.
- SECURITY: La clave secreta SHA-256 ya no se escribe en texto plano en los
- logs de depuración; se enmascara mostrando solo los 4 últimos caracteres.
- SECURITY: Las firmas de las notificaciones (IPN) de Redsys se verifican
- con hash_equals() (comparación en tiempo constante) en todos los
- gestores de notificación.
- SECURITY: El gestor AJAX de borrado de un token ahora exige la capacidad
- manage_woocommerce además del nonce.
Fixed
- Añadir una tarjeta desde Mi Cuenta en tiendas multidivisa podía ser
- Al añadir una tarjeta con la opción de suscripciones, el acuerdo COF
- Los pagos con tarjeta guardada (token R) y las renovaciones de
v31.0.1Unavailable
June 9, 20267.3 MBScanned
Fixed
- Bizum en página de pago (Bizum InSite) no enviaba la descripción
- La cuenta atrás del modal de Bizum en página de pago mostraba
Other
- a Redsys. El cobro real del modal usa la API REST (trataPeticionREST)
- y esa petición no incluía DS_MERCHANT_PRODUCTDESCRIPTION, por lo que la
- "Descripción Redsys" configurada (p. ej. "ID Pedido") llegaba vacía al
- panel de Redsys. Ahora se calcula con el ajuste seleccionado y se envía
- en la petición REST.
- 7 minutos. Ahora muestra 5 minutos y el control de tiempo en servidor
- que redirige al checkout se ajusta en consecuencia (60 iteraciones *
- 5 segundos = 5 minutos).
May 5, 20266.8 MBScanned
Added
- "Redsys email to customer" toggle in Redsys Advanced Settings → General to control whether DS_MERCHANT_EMAIL_TITULAR is sent to Redsys. When enabled and the Redsys terminal is configured to notify customers, Redsys sends its own purchase confirmation email to the buyer. Disabled by default — WooCommerce already sends its own order email, so existing installations stop forwarding the customer email to Redsys after the update. Applied to both Redsys Redirection and InSite gateways (classic and Blocks checkouts).
- Inline Express custom fields on the product page. When the feature is enabled and there are fields to collect, the form is now rendered above the Apple Pay / Google Pay buttons instead of in a post-click modal, with debounced auto-save to session. The click handler validates locally and starts ApplePaySession.begin() synchronously, preserving the iOS user gesture.
- Inespay periodic mandate now sends the recurring amount of the subscription instead of the parent order total. The gateway reads the recurring price from WooCommerce Subscriptions, SUMO Subscriptions, YITH WooCommerce Subscriptions, Subscriptions for WooCommerce (WP Swings) and Advanced Subscriptions for WooCommerce, and falls back to the order total only when no subscription amount can be detected. The order note created on mandate creation now includes the recurring amount that was actually sent to Inespay.
- Advanced Subscriptions for WooCommerce (ASWC) support in Inespay — the gateway detects the subscription id from order meta (aswc_subscription) and reads frequency, next payment date, end date and recurring amount via aswc_get_meta_data() to build the periodic mandate.
Fixed
- Apple Pay Express button on the product page failed to open the payment sheet on iOS Safari mobile when the Express custom fields feature was enabled. The pre-payment AJAX call (modal lookup or modal save) ran between the click handler and ApplePaySession.begin(), invalidating the iOS user-activation gesture so Safari silently aborted the session. The button still worked on desktop because desktop Safari is more permissive about gesture propagation.
- Express custom fields modal AJAX no longer fires when there are no fields to collect on the current page. The product page now precomputes whether any classic or Blocks-registered additional fields exist and disables the modal lookup entirely when the field set is empty, avoiding the gesture-breaking AJAX even on pages where the feature is enabled but no fields apply.
- Inline Express custom fields on the product page now try both Blocks and Classic contexts when reading additional fields, so fields registered through the Blocks API are also rendered on classic product pages.
- Inespay return handler now keeps the intermediate "Creating the mandate…" screen visible for a few seconds even when the periodic mandate link is already known on first load, so customers can read what is happening before being redirected back to Inespay to authorize the recurring mandate.
- Limited Inespay and Google Pay Redirection gateway icons to the same maximum size as Google Pay (max-width 110px, max-height 40px) in the classic checkout, preventing oversized logos when the bank-supplied image is too large.
- PHP warnings "Undefined variable $ship_address_usage / $ship_address_usage_ind" in class-wc-gateway-redsys-psd2.php when a guest customer (not logged in and no user id) checked out with a shipping address. Both variables were only initialized inside the logged-in branch but read in the outer block; they now default to first-use today, matching the existing else-branch behavior.
v30.3.1Unavailable
March 25, 20266.1 MBScanned
Other
- SECURITY [Medium]: Fixed an authenticated account takeover vulnerability that could allow an attacker to assume any user account, including administrators.
- SECURITY [Low]: Fixed unauthenticated access to order status and user data.
Fixed
- PayGold link generated from admin order metabox was never saved correctly due to an impossible response code condition in send_paygold_link(). The function now uses the same validation logic as the checkout flow (response code 9998).
- Fixed undefined $description variable in paygold_metabox_save() when sending a PayGold link from the order edit screen.
- Custom notification domain (redsys_url_notify) was broken by check_url() prepending home_url() to URLs that already had a different domain. check_url() now detects absolute URLs and preserves them as-is.
- get_notify_home_url() now automatically adds https:// when the custom notification domain is saved without a scheme.
- PHP 8.3+ compatibility — Fixed deprecated warnings for passing null/false to string functions (trim, strlen) from get_option() calls in get_txnid(), get_token_type(), and connect_standard_imap().
- PHP 8.3+ compatibility — Fixed add_submenu_page(null,...) in setup guide causing strpos()/str_replace() deprecation warnings.
v30.3.0Unavailable
March 11, 20266.1 MBScanned
Added
- Virtual / Downloadable Products order status override in Advanced Settings. When all products in an order are virtual or downloadable, the order status can be automatically set to Completed instead of Processing.
- Redsys response code 0115 (card cancelled or account closed) now automatically deletes the stored card token, notifies the customer with instructions to add a new payment method (My account > Payment Methods), and notifies the admin.
- Admin email notification when a customer's credit card is automatically removed due to Redsys hard-decline response codes (0115, 0172, 0173).
- Improved customer email when a card is removed — now includes the last 4 digits of the card, the error code, and a direct link to add a new payment method.
- COF_INI (Credential on File initial) flag is now saved to order meta (_redsys_cof_ini) for all COF transaction types (R and C), preventing duplicate token creation when COF_INI=N.
Fixed
- Conditional Rules test mode now correctly applies to the Redsys gateway URL. Previously, orders with conditional rules overriding test mode still used the default gateway URL.
- Fixed duplicate token creation when customer already has a saved card and COF_INI=N is sent to Redsys.
- Fixed undefined array key warnings in save_field_update_order_meta() when conditional rules data is incomplete.
- Fixed $redsys->debug reference using wrong variable in preauthorization logging (now uses $this->debug).
- Fixed sanitize_text_field applied before substr for HTTP_ACCEPT_LANGUAGE in Google Pay and Apple Pay Checkout, ensuring correct sanitization order.
- Google Pay Checkout now ensures WooCommerce transactional emails are initialized before calling payment_complete() in payment callbacks.
v30.2.1Unavailable
March 5, 20266.1 MBScanned
Fixed
- Google Pay Express Checkout now triggers WooCommerce transactional emails after successful payment (customer and admin).
v30.1.0Unavailable
February 21, 20266.1 MBScanned
Added
- Conditional Rules — visual rule builder to override payment parameters (terminal, merchant code, SHA256, transaction type, test mode, etc.) based on order conditions (category, tag, amount, currency, language, user role).
- Added preauthorization support for Google Pay and Apple Pay.
- Google Pay and Apple Pay now save merchant code to order meta for preauthorization operations.
- Added post_payment_complete hooks for Bank Transfer, IMAP email processing and Inespay gateways.
Improved
- Refactored InSite payment form error handling with AJAX-based refresh instead of full page reload.
Fixed
- Fixed InSite COF_TYPE detection that caused incorrect credential-on-file type in REST payments.
- Fixed Ds_Card_PSD2 using wrong variable in REST payment path.
- Fixed InSite orders being marked as paid without Redsys authorization when a third-party plugin filters woocommerce_cart_needs_payment.
- Improved InSite checkout routing using REST_REQUEST instead of checkout_use_block() for reliable shortcode/block detection.
Other
- SECURITY: Masked secret SHA256 key in debug logs.
Why archive
Sometimes the latest release isn't the one you need. The archive lets you pin Woocommerce Redsys Gateway to a known-good version, or roll back while a bug is investigated. Every release stays scanned and reachable.