fix: harden amount validation to prevent replay attacks

jimmyn · jimmyn · commit 26b9a3590756 · 2025-10-10T09:11:18.000+02:00
SECURITY: Changed from blind 1-cent exception to absolute difference check.

Previous code: if amounts don't match AND amount != 1 cent, reject
- Allowed ANY 1-cent payment to complete ANY order (replay attack)

New code: if absolute difference &gt; 1 cent, reject
- Allows exact matches
- Allows 0 EUR order + 1 cent (subscription validation)
- Prevents $0.01 payment completing $100 order

Applied to both IPN webhook and redirect verification.
diff --git a/includes/class-wc-monei-ipn.php b/includes/class-wc-monei-ipn.php
@@ -200,10 +200,13 @@ protected function handle_valid_ipn( $payload ) {
 			$order_total = $order->get_total();
 
 			/**
-			 * If amounts don't match, we mark the order on-hold for manual validation.
-			 * 1 cent exception, for subscriptions when 0 sign ups are done.
+			 * If amounts don't match (within 1 cent tolerance), mark order on-hold for manual validation.
+			 * Absolute difference check allows subscription validation (0 EUR + 1 cent) while preventing
+			 * replay attacks with mismatched amounts.
 			 */
-			if ( ( (int) $amount !== monei_price_format( $order_total ) ) && ( 1 !== $amount ) ) {
+			$expected_amount = monei_price_format( $order_total );
+			$amount_diff     = abs( (int) $amount - $expected_amount );
+			if ( $amount_diff > 1 ) {
 				$order->update_status(
 					'on-hold',
 					sprintf(
diff --git a/includes/class-wc-monei-redirect-hooks.php b/includes/class-wc-monei-redirect-hooks.php
@@ -217,8 +217,10 @@ private function verify_and_complete_order( $order_id, $payment ) {
 			$amount      = $payment->getAmount();
 			$order_total = $order->get_total();
 
-			// Verify amounts match (with 1 cent exception for subscriptions)
-			if ( ( (int) $amount !== monei_price_format( $order_total ) ) && ( 1 !== $amount ) ) {
+			// Verify amounts match (within 1 cent tolerance for subscriptions)
+			$expected_amount = monei_price_format( $order_total );
+			$amount_diff     = abs( (int) $amount - $expected_amount );
+			if ( $amount_diff > 1 ) {
 				$order->update_status(
 					'on-hold',
 					sprintf(
