WP Manifestindependent plugin directory
manifest / ecommerce / woocommerce-tcom-payway

PayWay Hrvatski Telekom payment gateway for Woocommerce WP RegistryHigh-severity findings · 1 findingOpen the reportC-

[WORDPRESS] Woocommerce plugin for payment service using PayWay HT payment gateway service

by Marin Šagovac · github.com/marinsagovac/woocommerce-tcom-payway · website

★ 29stars
1.8.6latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/marinsagovac/woocommerce-tcom-payway/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/marinsagovac/woocommerce-tcom-payway ↗

Woocommerce HT PayWay

Woo

Wordpress Woocommerce plugin (payment gateway for Croatia)

Support payment gateway for PayWay HT payment gateway.

PayWay

API

API 2.x.x support updated to latest IntlCurrency and IntAmount

Official Croatia Hrvatski Telekom PayWay.

PayWayForm Documentation revision supported: 7.1.10

FEATURES

Features

  • EUR mandatory currency, HRK set as IntAmount from 1.1.2023.
  • Added Currency code 978 and sent mandatory as CurrencyCode property ISO 4217 HR
  • IntlCurrency and IntAmount added
  • API 2.0 Support
  • Production and testing API
  • Added other languages with automation language switching on PayWay form
  • PayWay transaction admin page lists
  • WPML support conversion rate
  • Locale support based on WP locale settings (EN/HR)
  • Multilanguage support using po/mo translation
  • Replace banner image of PayWay on checkout with smaller 250px width
  • Not needle IntAmount and IntCurrency from 1.1.2024.
  • Support PHP 8.x

Removed

  • Removed woo-multi-currency support and integration
  • Removed T-Com names
  • Removed HRK to EUR conversion

RELEASES

OFFICIAL RELEASES

Latest version:

  • Version 1.8.6 December/2024

API 2.x.x:

  • Version 1.8.6 December/2024
  • Version 1.8.5 November/2024
  • Version 1.8.3 November/2024
  • Version 1.8.1 February/2024
  • Version 1.7.3 January/2023

Old releases (deprecated):

  • Version 1.7.1 January/2023
  • Version 1.7 December/2022
  • Version 1.6.1 September/2022
  • Version 1.5 November/2021
  • Version 1.4 June/2021
  • Version 1.3.3 January/2021
  • Version 1.3 December/2019
  • Release 1.2
  • Release 1.1

INSTALLATION

Download ZIP archive, upload via plugin page and apply package. Activate plugin. Change settings under Woocomerce settings page on the checkout page.

CHANGELOG

Changelog is now moved here.

HELP

Click here to go to WIKI Help page for more common mistakes and helps.

CONTRIBUTING

Thank you for considering contributing and developing features on our repository. We're continuing to improving, upgrading and fixing our repository using open source directive so specially thanks to contributors.

LICENSE

A source code is an open-sourced and is under MIT license and is possible to change or improve code.

Security

DEPRECATED DOCUMENTATIONS

Under wiki are screenshots of settings and admin preview of payments: here docs folder has been removed from 1.8.7 version.

TIP

You can buy me a coffe https://ko-fi.com/msagovac.

Releases

Newest 25 of 34 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.8.6 latest
Dec 1, 2024 1 year ago
tag only
—
1.8.5
Nov 30, 2024 1 year ago
tag only
—
1.8.4
Nov 22, 2024 1 year ago
tag only
—
1.8.3
Nov 22, 2024 1 year ago
tag only
—
1.8.2
Nov 20, 2024 1 year ago
tag only
—
1.8.1
Feb 28, 2024 2 years ago
tag only
—
1.8
Jan 19, 2024 2 years ago
tag only
—
1.7.3
Jan 7, 2023 3 years ago
tag only
—
1.7.2
Jan 7, 2023 3 years ago
tag only
—
1.7.1
Jan 6, 2023 3 years ago
tag only
—
1.7
Dec 30, 2022 3 years ago
tag only
—
1.6.1
Sep 26, 2022 4 years ago
attestation.intoto.jsonl
6
1.6
Sep 22, 2022 4 years ago
tag only
—
1.5
Nov 27, 2021 4 years ago
tag only
—
1.4
Jun 16, 2021 5 years ago
tag only
—
1.3.3
Jan 6, 2021 5 years ago
tag only
—
1.3.2
Dec 21, 2020 5 years ago
tag only
—
1.3.1
Jul 17, 2020 6 years ago
tag only
—
1.3
Nov 29, 2019 6 years ago
tag only
—
1.2
Feb 20, 2018 8 years ago
tag only
—
1.1
Dec 20, 2017 8 years ago
tag only
—
1.0.1
Sep 17, 2016 10 years ago
tag only
—
1.0
Aug 29, 2016 10 years ago
tag only
—
0.9b
Jun 18, 2016 10 years ago
tag only
—
0.9a
May 28, 2016 10 years ago
tag only
—
All releases on GitHub →
C- grade

Security

PayWay Hrvatski Telekom payment gateway for Woocommerce 1.8.6 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.8.6
Findings
1
Worst severity
high
Content hash
a0f0bd923afef9ca21dd49a2…

Findings

  • high Merchant PayWay secret key is rendered in the checkout payment form

    information_disclosure

    generate_ipg_form builds the hosted-form POST to form.payway.com.hr and includes acq_id => $this->acq_id in the hidden fields. acq_id is the gateway setting labeled Secret Key and is the same value used to compute the outgoing SHA-512 Signature (ShopID . secret . order_id . secret . amount . secret). receipt_page echoes that HTML on the WooCommerce order-pay URL (process_payment redirects there with get_checkout_payment_url(true)); the form auto-submits via jQuery but the markup is fully visible in the page source. Any guest or customer who starts a PayWay checkout therefore receives the live merchant signing secret. PayWay’s documented form fields do not include the secret (only Signature). With the secret, an attacker can forge valid PayWay authorization requests in the merchant’s ShopID and, once callback verification is added, forge return signatures until the key is rotated.

    classes/class-wc-tpayway.php:325-375

    Recommendation

    Remove acq_id (and any other secret) from the client-side form. Send only PayWay-documented fields (ShopID, ShoppingCartID, Version, TotalAmount, ReturnURL, CancelURL, Signature, customer fields, CurrencyCode). Keep the secret server-side, rotate the current key in the PayWay merchant portal, and never log or echo it.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →