Looking for a WooCommerce Redsys Gateway Coupon Code for WooCommerce Redsys Gateway, Version 32.1.0?
Click to get this plugin for only $25 (massive discount): WooCommerce Redsys Gateway, Version 32.1.0
No coupon code needed to save.
Some things have changed in WooCommerce Redsys Gateway Version 32.1.0. You may want to upgrade to this new version if these impact your installations.
* SECURITY: The plugin was writing the address of every shopper's order-received page into its own log file on every payment, and that address contains the order key - the private token that WooCommerce puts in the shopper's payment link and that this plugin requires before it will show an order. Anyone able to read the log file could therefore open those orders and see the name, email, telephone and addresses on them. It happened whether or not the shop had switched debug logging on, because this one place wrote to the log without checking that setting. It now respects the debug setting like every other log the plugin writes, and the key is replaced with "[redacted]" before anything is written, so it is not recorded even with logging switched on. That replacement was then applied to every log line the plugin writes rather than to the one that was reported: around ninety further lines across the gateways printed the same addresses whenever debug logging was on, including the ones that dump the whole message sent to the bank. Log files already written still contain those addresses: if you have them, delete them.
* FIX: With InSite, paying with a card the shopper had saved could take the money and still show the order as failed. When the bank approves such a payment without asking the shopper to confirm with their bank app - which is what happens with a saved card - the plugin was looking for the result in the wrong place, found nothing, and treated "nothing" as a refusal. The charge had already gone through, so shoppers who were told the payment had failed paid a second time and were charged twice. The result is now read from the bank's own signed answer, the same one the rest of the payment already uses. It affected the classic checkout and the block checkout equally, and it also affected subscription renewals. Reported by two shops within days of each other, one of whom traced it to the exact line - thank you.
* FIX: On the card gateway, a payment made with a saved card was completed on the strength of an authorisation number alone, without checking the bank's actual answer beside it. A refused payment that still carried something in that field would therefore mark the order as paid, and the shop would send the goods without having been paid. Both are now required to agree before an order is completed. If the bank's answer is missing altogether the payment is not completed, because there is nothing left that says it was approved; a shop whose bank genuinely omits that field can restore the previous behaviour on purpose with the redsys_allow_payment_without_ds_response filter, which is documented and which cannot be used to accept a payment the bank actually refused.
* FIX: On stores using certain checkout plugins - Fluid Checkout among them - every payment was refused by Redsys with the error SIS0574. The bank requires a short description of the shopper's browser with each payment (its language, its screen size and similar), which the plugin collects through hidden fields it adds to the checkout. Those fields were being added at the moment the card gateway was built, which on those stores happens after another plugin has already asked WooCommerce for the definitive list of checkout fields - and WooCommerce builds that list once and never again. The fields were therefore never created, never filled in and never sent, and the bank refused the payment. They are now added as soon as the plugin loads, before anything can ask for the list, which affects every gateway that needs them - the card gateway, Bizum and the wallets - not only InSite. In InSite the browser description now also travels with the rest of the payment data instead of depending on the order alone, so it survives a checkout that rebuilds itself. Reported by an integrator who had already proved the diagnosis - thank you.
* SECURITY: The page that forwards a shopper to Redsys (and to Bizum) accepted any order number typed into its address, without checking that the person asking for it was the person who placed that order. Because order numbers run in sequence, someone could step through them and read the data the plugin sends to the bank for other customers' orders: name, email, telephone and the billing and delivery address, together with the amount and the description of what was bought. No card number, no security code and no signature key were ever exposed, and nothing could be paid or modified this way. That page now requires the order key that WooCommerce puts in the shopper's own payment link, so a request that does not belong to the order is refused with a "Forbidden" page instead of being answered. The same check was added to the payment pop-up on the checkout page. Reported by the security team at Tivify (TVUP Streaming Media), who described the problem clearly and gave us the time to fix it before saying anything publicly - thank you.
* FIX: If a payment was cancelled or refused, the shopper came back to the shop but the order was left pending and the basket was not restored. The address the plugin gave the bank to send the shopper back to was written in the form used for links inside a web page, not the form used for a real address, so the shop received the return without the order reference, its number or its security token and had nothing to cancel. It affected Bizum, Google Pay, Apple Pay, direct debit, bank transfer, InSite and the card gateway whenever the "return to" setting is set to cancel the order. On MasterPass the same address was being sent completely empty, because of a typing mistake of a single character repeated on three lines. All of it now goes through a single shared piece of code, so a gateway added in the future cannot get it wrong again.
* FIX: In the pop-up (modal) payment mode, cancelling a payment did nothing and the shopper was left on the cart with the order still pending. The address the plugin sent the browser to was being written into the page in a way the browser reads as a link inside a document rather than as a web address, so everything after the first parameter was discarded - the order reference, its number and its security token all disappeared, and WooCommerce had nothing to cancel. The same flaw affected the address the shopper is returned to after paying, where it silently dropped a tracking parameter. Both are fixed, in the card gateway and in the InSite gateway, and the corrected behaviour was verified in a real browser.
* FIX: The checkout could die with a critical error, instead of sending the shopper to the bank, for a logged-in customer whose customer record had never been changed since it was created. The plugin builds a set of security data for the bank on every payment, and one of the fields is the date the customer account was last modified - which WooCommerce leaves empty for an account that has never been touched, typically one created by an import, a migration, or automatically by another plugin. The plugin read that empty date as if it were a real date and the payment page stopped there. It now falls back to the date the account was created, which is what "never modified" means, and the same protection was added to the equivalent code used by subscriptions - where the same empty date was silently being reported to the bank as "modified today", which is wrong information for the bank's fraud checks.
* SECURITY: The three preauthorization buttons in the order screen (authorise, cancel, charge a deposit) and the PayGold customer search accepted their requests without a security token. The permission check was already in place, so only a shop manager or administrator could ever use them, and nobody else could have run them - but an administrator who was already logged in could have been tricked into firing one from another website without noticing. All four now carry and verify a WordPress security token, which closes that path.
* FIX: Redsys and the other gateways could disappear from the checkout for everyone, including ordinary shoppers, on stores where the "show only to these users" list in test mode had never been filled in. The plugin read that empty setting as "show it to one user whose id is nothing", which matches nobody, so the payment method was hidden from every visitor. It only affected stores whose settings were written by something other than the settings screen - an import, a migration, or the plugin's own management API - because saving that screen by hand stores a different empty value that never triggered it. Fixed in the nine gateways that shared the same code.
* FIX: Subscriptions paid with Apple Pay or Google Pay by a customer without an account never obtained the recurring payment permission from the bank, so the first renewal failed with a note saying there was no card. It happened on stores where the general "allow customers to create an account during checkout" option is switched off, which is common on stores that allow guest checkout: the wallet payment paths never saw WooCommerce Subscriptions' own override of that option, so no account was created and, without an account, the bank permission could not be stored. Fixed in the four places that handle it (Apple Pay and Google Pay, on both the classic and the block checkout).
* FIX: The block checkout's payment script was built against a version of React that WordPress itself does not accept. A development-only dependency pulled a newer React into the build, and WordPress rejects elements produced by it, so the payment method could fail to appear on the block checkout. The build now pins the version WordPress uses and the script has been rebuilt.
* CHANGE: When a subscription renewal fails, the note added to the order now says exactly which step failed and which merchant code and terminal were used for the attempt. Until now all six possible failures wrote the same uninformative note, which made a failed renewal almost impossible to diagnose without access to the store - especially on stores where the debug log is not being written.
* CHANGE: When Apple Pay cannot validate the shop with Apple, the log now records Apple's own explanation and whether the certificate files can be read. Apple answers with a generic "Expectation Failed" and puts the real reason in the body of its reply, which was never being recorded, so those failures used to be a dead end.
* NEW: The WooCommerce status report (WooCommerce - Status) now also lists what is switched on in the Redsys "Advanced settings" tab: push notifications, sequential invoices, QR codes, saved cards, order status overrides, conditional rules, subscriptions, e-mail reconciliation, the agentic commerce protocols and the management app API. Credentials are never printed - each one is reported only as set or not set. It is included when you copy the report to send it for support, which is the point: a support request now arrives with the configuration already in it.
* CHANGE: The distributed plugin no longer contains the project's own development and build scripts, its local test environment configuration, its editor and git-hook directories, its developer README or an internal security review document. None of it was ever loaded when the plugin runs, but none of it belongs on a shop's server either. What the package contains is now checked automatically, before every release, against a list of what the plugin really ships, so something added to the project in the future cannot travel inside the zip unnoticed.
* FIX: The cart and the checkout could become noticeably slow, for logged-out visitors too, on stores with saved cards or subscriptions. The plugin's internal helper WCRed() built a brand new copy of its global object every single time it was called, and that object registers three WordPress hooks the moment it is built. WordPress does not replace those hooks, it adds them, so on a store where the helper is called once per saved card or subscription the same three checks ended up registered hundreds of times and were re-run, all of them, every time WooCommerce assembled the list of available payment gateways. On a store that reported the problem this reached around 438 duplicated registrations per page load and about 1.7 seconds of PHP work on the cart page, of which only 56 milliseconds were database queries. The helper now builds that object once and reuses it, so the hooks are registered exactly once per request. Nothing about the plugin's behaviour changes: the object holds no per-request data. The same one-object-per-request treatment was applied to the WCPSD2() helper, which had the identical shape.
* FIX: On a small share of stores the Agentic Commerce (UCP) message-signing key was written in a form that could never be used, so every signature check against it failed and the published key document did not follow the standard. When the plugin created that key, one of its two coordinates occasionally came back from OpenSSL one byte shorter than the standard requires - about 1 store in 135 - and the plugin stored it as it was instead of padding it. From that moment the store could not verify its own signatures, and no external agent could either, until the key was rotated. The key is now stored padded to the required length, and a key already stored in the short form is repaired automatically the first time it is read, so no merchant has to rotate anything.
* FIX: On shops running PHP 8.0 or older, switching on the e-mail reconciliation broke the page with a server error instead of simply not working. The plugin now checks first and leaves a clear note in its log. The feature itself still needs PHP 8.1.
* SECURITY: The Agentic Commerce Protocol could end up switched on without anyone choosing it, on shops that update automatically. It publishes addresses that machines can talk to, so it is meant to be off unless you turn it on - and now it is. If you did switch it on, nothing changes for you.
* FIX: Background jobs were piling up into dozens of copies of themselves in the WooCommerce scheduled actions list. Fixed everywhere the plugin schedules anything, and the copies already there are cleared automatically.
* CHANGE: The e-mail reconciliation job now exists only while that feature is switched on, and only once. Before, it was created on every shop and woke up every five minutes doing nothing.
* FIX: A notification to the mobile app could be lost without any error if it was sent at the wrong moment.
* FIX: PHP warnings appeared in the server log on every visit to the "pay for order" page, from the Apple Pay and Google Pay gateways. Nothing was broken for shoppers, but the debug log for those gateways was not recording anything from that step - so anyone trying to diagnose a problem there was looking at a fault, not at silence. Reported by a merchant, and found in three gateways rather than the one reported - thank you.
* FIX: Turning the debug log on to look into a card payment problem produced warnings instead of the information you turned it on for.
* FIX: The "Connect with Google" button in the e-mail reconciliation settings was never displayed. Granting access was already possible by filling in the Google details and pressing "Save changes", so this restores a shortcut rather than unlocking the feature.
* SECURITY: The Google library bundled with the plugin has been updated, fixing two flaws in the part that makes network requests.
* CHANGE: All the translations are complete again. Sixty-nine texts added by recent versions were still showing in English - settings labels, the status report, and a few messages a shopper can see. Spanish, Catalan, Basque, Galician, French and Portuguese are back at one hundred per cent.
* NEW: You can now decide whether customers are offered "Add a credit card for Subscriptions" in My account - Payment methods. Until now that option appeared by itself as soon as a subscriptions plugin was active, with no way to remove it, which is not what every shop wants: on a shop where the card for a subscription is always captured during the purchase, it only invited customers to store a card nothing would ever charge. The new switch is in Redsys - Advanced settings - Saved Cards, it starts switched on so nothing changes for shops that were already offering it, and switching it off leaves the 1-click card on its own. It is also reported in the WooCommerce status report.
* FIX: The plugin sent the shop an e-mail saying "Redsys is not sending tokenization fields" after payments in which Redsys had sent every one of them. The check behind that notice tested a variable that does not exist anywhere in the plugin, and a test on something that does not exist is always true, so the warning went out on every payment that saved a card. Merchants were taking it to their bank, which correctly answered that the terminal was fine. The notice now reports only real absences, and it names in the log which field was missing - the expiry date, the card brand or the card number - instead of only saying that something was. It also had to stop reading the brand after the plugin had turned it into a display name, because that conversion answers "Unknown" when there is no brand, which would have turned the warning into one that could never appear at all. The same block was writing "unknown" as the card number in the debug log on every payment, through a variable name that carried one letter too many; it now writes the real masked number.
* FIX: Searching the Redsys tokens screen (WooCommerce - Redsys tokens) by e-mail or username could not find any card saved after the first twenty-five. The screen asked the database for one page of tokens and then searched inside that page, and since it asked for them in no particular order, that page was always the twenty-five oldest tokens in the shop - so the recently saved cards, which are the only ones anybody looks for, were unreachable. The search now runs in the database, over every token, and the listing arrives newest first. The counter above the table and the list below it can no longer disagree, sorting by username or e-mail now sorts the whole table instead of the visible page, and the screen no longer loads every token in the shop into memory just to count them, which on shops with thousands of saved cards it did on every page load.
* CHANGE: The token that guards the "add a card" link is now compared in constant time, like every other secret this plugin compares. Timing that comparison over the internet is not a practical attack, so nothing was exploitable; the inconsistency was the defect, because this was the one comparison left behind when the rest were migrated during the signature work.
What does it include? WooCommerce Redsys Gateway, Version 32.1.0 includes…
- 12 months of free updates
- Use on unlimited sites (no ‘license by seat’ limits)
What doesn’t it include?
It does NOT include support or automatic updates. However, includes access to 12 months of updates, which can be applied manually.
(No Ratings Yet)
Loading...