Pay4All TWINT – For WooCommerce & Pay4All Shop

Changelog

1.3.0

• Security — merchant certificate no longer at a predictable URL. The TWINT PEM (private key + certificate) used to be written to wp-content/uploads/t4a_twint/twint.pem — a fixed, guessable path protected only by .htaccess deny from all. On nginx (which silently ignores .htaccess) or Apache with AllowOverride None, the file was directly downloadable. Each merchant now gets a random 48-hex filename minted per install (stored in t4a_twint_settings_certfile), the containing folder ships both an index.php and an .htaccess (belt-and-suspenders), and the file is chmod’d to 0600. Certificate renewal via TWINT backoffice also mints a fresh name, so a previously exposed URL is invalidated.
• Security — certificate password encrypted at rest. The password protecting the private key was stored in cleartext in wp_options and re-emitted in the wizard HTML + AJAX response + parsing error message. It is now stored encrypted via authenticated encryption (see below), never echoed back to the DOM (the field renders empty with a « laissez vide pour conserver » hint), and the « Failed to parse certificate » error no longer includes the provided password.
• Security — authenticated encryption for stored secrets. Cipher was AES-256-CTR with a length-checked salt suffix — malleable, no MAC, key material was LOGGED_IN_KEY used raw. Replaced with sodium_crypto_secretbox (XChaCha20-Poly1305) with an openssl aes-256-gcm fallback, keyed via HKDF-SHA256 from LOGGED_IN_KEY + LOGGED_IN_SALT. Ciphertexts written by earlier versions keep decrypting (backward-compatible reader) so no data loss.
• Security — TWINT return signature now expires. The signature on the redirect / cancel URL was computed with a fixed t=1, meaning it was replayable indefinitely. It now embeds the real timestamp and rejects any URL older than T4A_REDIRECT_SIGNATURE_EXPIRATION (bumped from 60 s to 30 min so realistic TWINT-app flows are not rejected).
• Security — FileServer defense-in-depth. Internal basename() + type whitelist + realpath bounding are now enforced inside send_file() / display_pdf(), in addition to the callers’ existing sanitisation. Any request that escapes the allowed upload directory returns HTTP 404.
• Security — nginx-proof folder protection. t4a_twint/, logs/, temp/, locks/ now systematically ship both .htaccess and an empty index.php so servers that ignore .htaccess still can’t list or serve them.
• Internal : EnvironmentConfig::get_certificate_file_path() is resolved LIVE (not from the T4A_CERTIFICATE_PATH constant frozen at boot) so a cert upload followed by a connection test in the same request reads the just-written file. Same for the certificate password — the SoapClient reads it via get_certificate_password() instead of stripcslashes(get_option(...)).

1.2.0

• Wizard rework — new « Commande » tab. The setup wizard now has 4 steps (Préparation, Identifiants, Commande, État). The « Commande » tab merges the Pay4All Shop and WooCommerce post-payment order-status configuration into a single unified card, with matching labels (« Commande contenant… ») between both integrations and editable status pickers.
• Standalone boot. The plugin no longer requires Pay4All Shop to be present at activation. When the companion is missing, a scoped admin notice explains what’s needed instead of blocking activation. WooCommerce-only merchants can install Pay4All Pro next to this plugin and skip Pay4All Shop entirely.
• Pay4All Pro compatibility. The Commande tab detects when Pay4All Pro is active and offers a « Plus de réglages » shortcut to admin.php?page=pay4all-twint-woo, keeping advanced WooCommerce settings in a single place.
• Localized tutorial link. The « Besoin d’aide » block in the Préparation tab now points to https://pay4all.ch/p/twint-woocommerce#tutorials in FR/DE/IT/EN.
• Internal : FormDomainEvents.mark_payment_paid delegates to a shared paid_status_for_p4all_form_order() helper so Pay4All Shop and WooCommerce share the same virtual/deferred/default logic.

1.1.0

• SOAP client rewritten in non-WSDL mode. The full TWINT Merchant Service v8.4 WSDL/XSD contract (previously shipped as .xml schema files under src/Engine/Soap/schemas/v8_4/) has been removed from the plugin package per WordPress.org’s blanket file-type policy. Every SOAP request is now built as a hand-written XML envelope inside TwintSoapClient::dispatch(), transported by \SoapClient in non-WSDL mode (mTLS + gzip + timeouts unchanged), and the response is parsed by an in-house DOMDocument → stdClass converter that mimics SoapClient’s classic ->_ shape so every existing consumer ($response->Order->Status->Status->_, etc.) keeps working. Validated live against production TWINT on a small-amount payment + refund round-trip (StartOrder → GetOrder polling → ConfirmOrder → REVERSAL).
• Sensitive payloads no longer logged. The SOAP journal used to record the full $args request payload and $response object for every operation. On WordPress.org’s review request the plugin now only logs the operation name + message id, never the payload. Applies to TwintSoapClient, TransactionService, BackofficeTransactionService and AdminAjax::check_successful_order_statuses. Debug-only print_r( $this->client ) block removed.
• Internal : set_headers(), send_soap_request(), get_default_params() retired ; replaced by dispatch() + build_envelope() + merchant_information_xml() helpers.

1.0.0

• Initial release on WordPress.org.
• TWINT integration for the free Pay4All Shop plugin.
• Setup wizard, certificate handling, cash-register enrollment.
• French, German, Italian and English translations bundled.