WordPress.org
Get WordPress

Plugin Directory

Changeset 3460483


Ignore:
Timestamp:
02/13/2026 04:24:35 AM (7 weeks ago)
Author:
webimpian
Message:

Patch vulnerability

Location:
bayarcash-wc/trunk
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • bayarcash-wc/trunk/bayarcash-wc.php

    r3460478 r3460483  
    1313 * Plugin Name:         Bayarcash WC
    1414 * Plugin URI:          https://bayarcash.com/
    15  * Version:             4.3.13
     15 * Version:             4.3.14
    1616 * Description:         Accept payment from Malaysia. Bayarcash support FPX, Direct Debit, DuitNow OBW & DuitNow QR payment channels.
    1717 * Author:              Web Impian

  • bayarcash-wc/trunk/includes/src/Gateway.php

    r3460478 r3460483  
    445445        }
    446446
     447        $payment_method = $order->get_payment_method();
     448        $payment_data = $this->get_payment_settings($payment_method);
     449        $settings = $payment_data['settings'];
     450
     451        if (empty($settings)) {
     452            $this->log('Invalid payment method for pre-transaction verification.', $order);
     453            return;
     454        }
     455
     456        $this->initialize_bayarcash_sdk($settings);
     457
     458        if (!$this->verify_transaction_callback($response_data, $settings, $order)) {
     459            $this->log('Pre-transaction checksum verification failed.', $order);
     460            return;
     461        }
     462
    447463        $transaction_exchange_no = $response_data['transaction_id'];
    448464        $exchange_reference_number = $response_data['exchange_reference_number'];
    … …  
    455471        }
    456472
    457         $order->update_status('pending');
    458473        $this->store_post_meta_transaction_exchange_no($order_no, $transaction_exchange_no);
    459         $this->log("Order status set to 'pending' and Transaction Exchange No. stored in wp_post meta.", $order);
     474        $this->log("Transaction Exchange No. stored in wp_post meta.", $order);
    460475    }
    461476

  • bayarcash-wc/trunk/readme.txt

    r3460478 r3460483  
    9393== Changelog ==
    9494
     95= 4.3.14 =
     96* Security: Removed unauthorized order status change in pre-transaction callback
     97
    9598= 4.3.13 =
    9699* Security: Added nonce verification to admin AJAX settings handler
Note: See TracChangeset for help on using the changeset viewer.