WP Manifestindependent plugin directory
manifest / ecommerce / tpaga-woocomerce-plugin

Tpaga Web Checkout para WooCommerce WP RegistryHigh-severity findings · 4 findingsOpen the reportD+

by Tpaga · github.com/tpaga/tpaga-woocomerce-plugin · website

★ 4stars
v1.02latest · 10 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/tpaga/tpaga-woocomerce-plugin/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/tpaga/tpaga-woocomerce-plugin ↗

Tpaga Web Checkout para WooCommerce

Tpaga WebCheckout es un servicio de Tpaga con el cual sus clientes podrán realizar pagos de manera agíl y sencilla. Este plugin es una implimentación de Tpaga WebCheckout para Wordpress para ser utilizado en conjunto con Woocommerce (Nos encontramos en Beta).

Requerimientos mínimos

  • Wordpress 4.4.2 (Probado 4.5)
  • WooCommerce 2.0 ó posterior

Integración del plugin con Wordpress

Debido a que este plugin es una extensión de Woocomerce, es necesario tener dicho plugin instalado en su instancia de Wordpress.

  1. Descargue el zip de este repositorio.
  2. Visite /wp-admin/plugin-install.php y cargue el archivo .zip en el formulario.
  3. Seleccione Tpaga en la ficha de checkout ubicada en WooCommerce > Settings > Checkout > Tpaga
  4. En el formulario deberá activar a Tpaga como medio de pago.
  5. Los campos Merchant Token y Secret son generados al registrase en Tpaga WebCheckout
  6. Si desea hacer transacciones de prueba seleccione el botón Transacciones en modo de prueba.

Con esta breve configuración usted esta listo para hacer cobros utilizando Tpaga WebCheckout.

NOTA : Si el titulo de la página de respuesta es Page Not Found revise la configuración de los permalinks. wordpress is giving me 404 page not found

Releases

3 releases.

Tag
Published
v1.02 latest
Sep 27, 2016 10 years ago
v1.01
May 12, 2016 10 years ago
v1.0
Apr 19, 2016 10 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Tpaga Web Checkout para WooCommerce 1.02 · audited by WP Registry

High-severity findings.

2 high 2 medium
Audited release
1.02
Findings
4
Worst severity
high
Content hash
ef178791ec7b146cf8727f9a…

Findings

  • high Reflected XSS on payment_confirmation when signature=customererror

    xss_reflected

    If $_REQUEST['signature'] === 'customererror', payment_message is echoed unescaped into HTML. Unauthenticated attacker can inject script via payment_message query param.

    payment_confirmation.php:6-8

    Recommendation

    Escape with esc_html(); never trust gateway flash messages.

  • high Direct-access payment callbacks via relative wp-blog-header.php

    file_access

    process_response.php and payment_confirmation.php require '../../../wp-blog-header.php' and are web-accessible under wp-content/plugins/... Enabling payment_complete on signed webhook and XSS page outside normal WC API routing.

    process_response.php:1-4

    Recommendation

    Route through WC API/checkout endpoints; block direct plugin-file access; use ABSPATH bootstrap.

  • medium Loose signature comparison and unescaped signed fields

    missing_escaping

    Signature verified with == (not hash_equals). On success, payment_state/description/etc. echoed without escaping (XSS if secret leaked or algorithm weakened).

    payment_confirmation.php:26-68

    Recommendation

    Use hash_equals; escape all echoed fields.

  • medium Webhook marks orders paid without amount/currency re-check

    unsafe_input

    process_response.php trusts signed payload fields including purchase_order_id and calls payment_complete without verifying order total matches purchase_amount.

    process_response.php:26-34

    Recommendation

    Re-validate amount/currency against WC_Order before payment_complete.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →