WooCommerce Redsys Gateway Version 32.2.0 Changelog

Here’s what’s changed in WooCommerce Redsys Gateway Version 32.2.0

  
* DEV: The package published on WooCommerce.com no longer includes the license and update client used by copies bought at plugins.joseconti.com (it was never loaded there). The plugin loads it only when the file is present.
* DEV: Added phpstan.neon (bundled third-party libraries excluded, baseline of existing findings) so static analysis reports only new problems.
* FIX: InSite: the "Language Gateway" setting was ignored, so the card fields (placeholders and button) were always shown in Spanish. The chosen language is now sent to Redsys in the classic checkout and in the Checkout Block.
* NEW: Filter redsys_insite_form_language, to choose the language of the InSite card form from code (for example, one per site language).
* FIX: Updating with UCP enabled ended in a "critical error" (Call to a member function using_index_permalinks() on null) on the first page load after the update. The public UCP discovery file is now rewritten once WordPress has finished loading.
* FIX: Expired saved cards: the scheduled tasks that warn the customer and remove expired cards failed with a database error ("You have an error in your SQL syntax") and never did anything. They now work, remove cards that expired in an earlier year too, and only touch cards saved by this plugin.
* FIX: Customers with more than 10 saved cards: subscription renewals and the Immediate Redsys Charge could use an older card instead of the newest one, a card already saved could be saved again, and the classic checkout did not list the newest cards. The plugin now reads all the Redsys cards of the customer for its own decisions.
* NEW: Filter redsys_customer_tokens_limit, to change how many saved cards of a customer the plugin reads (500 by default).
* FIX: License: when the license server refused the activation, the settings page only said "Your settings have been saved.". The error returned by the server is now shown, and a refused key is no longer displayed as "License is Active".
* FIX: License: saving Redsys Advanced with the license already active sent it to be activated again on every save. An active license is no longer re-sent.
* FIX: Immediate Redsys Charge (and any charge with a saved card): when Redsys rejected the charge at its first step, the order stayed pending with no explanation. The reason and the Redsys error code are now written in an order note.
* FIX: InSite in the block checkout: a card saved for Pay with One Click after a 3DS challenge was stored as a subscription card. It is now stored with the type it was requested with.
* FIX: InSite in the block checkout: the pay button always read "Pagar". It now shows the translated "Pay" label of the site language.
* FIX: InSite in the block checkout: on a server without the PHP SOAP extension the payment ended in a "critical error". The customer now gets a message asking to choose another payment method, and the cause is written to the InSite log.
* FIX: Classic checkout: with Bizum and Bizum Checkout both in test mode, the test-mode warning was shown twice.
* FIX: One-click purchase from the product page: the shipping options showed "€" instead of the currency symbol.
* FIX: Confirming a pre-authorisation wrote the order status note twice, and moved the order to Completed even when another status was configured for confirmed pre-authorisations.
* FIX: Block checkout: when Bizum Checkout was denied the customer was sent back to the checkout with no message. The error is now shown, as it already was in the classic checkout.
* FIX: Block checkout: an order paid with Bizum (or another gateway of this plugin that uses a payment page) by a customer with a saved card was recorded as paid by card. The order keeps the payment method it was placed with.
* FIX: Bizum, Bizum Checkout, Google Pay, Apple Pay, Direct Debit and PayGold in test mode: with the test key configured and the real key field empty, the payment was authorised by Redsys but the order stayed pending, because the notification was rejected. In test mode the notification is now verified with the test key.
* FIX: Block checkout: paying with a saved card (Pay with One Click) was rejected by Redsys with error SIS0574 (browserUserAgent not indicated). The 3DS browser data is now attached to the order in the block checkout too.
* FIX: Apple Pay: the debug log now shows the parameters actually sent to Redsys, read back from the signed request. Before, its lines were written separately and could differ from the request: the subscription parameters were sent but not logged, and the Apple MerchantID line was logged even when it was not sent.
* FIX: My account > Payment methods: the "Type" column printed PHP warnings (Undefined array key "delete", Undefined variable $token_type_name) on cards or accounts saved by other gateways, for example PayPal. It now describes only the cards saved by this plugin and shows "--" for any other saved method.
* FIX: Bizum Checkout: the waiting page shown while the payment is confirmed loaded jQuery from ajax.googleapis.com. It now uses the copy WordPress ships, so the page makes no request to a third party.
* FIX: readme.txt declared a malformed license line and "Tested up to: 7.0" while the plugin header said 7.1. Both files now say GPL-3.0-or-later and 7.1.
* FIX: ACP (off by default): with ACP on, WordPress could log "Translation loading for the woocommerce domain was triggered too early" when the hourly ACP clean-up was first scheduled. It is now scheduled on init.
* FIX: Duplicated scheduled actions left by earlier versions are now removed on their own: the paired redsys_acp_process_webhooks / redsys_ucp_process_webhooks workers, a redsys_check_emails_cron with no group, and repeated daily clean-ups. Since 32.1.0 no new ones were created, but existing ones stayed.
* FIX: The plugin's text domain is now its slug, woocommerce-gateway-redsys (it was woocommerce-redsys), in every string, in the bundled translation files and in the Checkout Blocks scripts. Custom translation files saved under the old name in wp-content/languages/plugins or by Loco Translate keep working. Translations stored in the database by a multilingual plugin (WPML String Translation, Polylang) and custom code that filters gettext by the old domain need the new name.
* FIX: Three strings used WooCommerce's text domain and four order-status counters had none; one of them (the cancelled-order plain e-mail) could never be translated. They now use the plugin's.
* FIX: Subscription renewals sent no description to Redsys, so the operation showed an empty description in the TPV (first payments were fine). Renewals and invoice charges of the redirect gateway, and renewals of InSite, now send the description chosen in the gateway settings, as they did before renewals moved to the REST API.
* FIX: Paying at checkout with a saved card (redirect gateway) always sent "Order N" as the description, whatever the gateway setting said. It now follows the setting.
* FIX (security): UCP MCP (off by default): an agent could ask lookup_catalog for any number of products and get an answer of any size. A lookup now takes at most 50 products and no tool returns more than 1 MB (both adjustable with filters).
* FIX (security): UCP MCP (off by default) kept no record of what agents did. Every tool call is now written to an audit log (which agent client, which tool, the result and its duration; arguments only as a fingerprint and a masked summary), kept for 90 days.
* FIX (security): UCP MCP (off by default) had no request limit. Each address also has a budget checked before authentication (300 calls per minute by default), and a batch request carries at most 20 calls.
* FIX (security): UCP MCP (off by default) had no request limit. Each agent client now has a budget of 60 tool calls per minute, 600 per hour and 5000 per day (the same as A2A, adjustable with the redsys_ucp_mcp_rate_limits filter); past it, calls get a 429 error.
* BEHAVIOUR CHANGE (security): UCP MCP (off by default): tool arguments are now checked against each tool's published input schema before the tool runs; calls that do not match (for example without meta.ucp-agent.profile) get a JSON-RPC -32602 error listing what is wrong.
* FIX: ACP (off by default): the public ACP document announced a limit of 60 requests per minute that was never applied. The announcement is removed.
* BEHAVIOUR CHANGE (security): UCP (off by default): Dynamic Client Registration - any AI agent creating its own OAuth client in the store - is now off by default, and switched off once on update where it was only on by the old default. If your agents register themselves, turn "Allow Dynamic Client Registration" back on in the UCP settings.
* FIX (security): ACP (off by default): its "HTTPS required" check believed an X-Forwarded-Proto or X-Forwarded-SSL header from anyone. These headers now count only from the proxies listed in the "Trusted proxies" setting (A2A > Status). HEADS-UP: behind a proxy or CDN that ends HTTPS, list its addresses there after updating.
* FIX (security): UCP OAuth (off by default): authorization codes were stored in the database in plain text while tokens were hashed. They are hashed now too.
* BEHAVIOUR CHANGE (security): UCP OAuth (off by default) now accepts only the S256 PKCE method, as the UCP profile requires; "plain" is refused. A developer who needs it can return true from the redsys_ucp_allow_pkce_plain filter.
* BEHAVIOUR CHANGE (security): UCP OAuth (off by default): the token introspection endpoint answered anyone. It now requires the calling client's credentials (client_id and client_secret) and only reports on that client's own tokens, as RFC 7662 requires.
* FIX (security): A2A (off by default): after the card authentication step, the shopper could be sent to any address the agent had given, including plain http or internal addresses. Only https addresses on public hosts are used now; otherwise the shopper lands on the order page. The redsys_a2a_sca_return_url filter can narrow this further.
* FIX (security): UCP MCP (off by default): when a tool failed inside the store, the agent received the internal error text (which can include server paths). It now receives a correlation id; the detail is written to the plugin log.
* BEHAVIOUR CHANGE (security): UCP and A2A (off by default) no longer accept the access token in the URL (?access_token=), where it ends up in server logs; send it in the Authorization header. A developer who needs the old behaviour can return true from the redsys_allow_bearer_in_query_string filter.
* FIX (security): UCP OAuth (off by default): two token requests sent at the same time with the same authorization code could both succeed. The code is now redeemed atomically; only one request gets tokens.
* FIX (security): Inespay: after checking the notification's signature, the plugin still let unsigned fields of the request fill in values the signed data did not carry (such as the payment id). Only the signed data is used now.
* FIX (security): Apple Pay and Google Pay marked the order paid without checking that the amount Redsys charged matched the order total, as card and Bizum payments already do. A different amount now puts the order on hold with a note, for you to review.
* FIX: UCP OAuth (off by default): two refreshes sent at the same time with the same refresh token could both obtain a new token pair. The refresh token is now spent atomically; the second request gets invalid_grant.
* FIX (security): A2A (off by default): when an operation failed inside the store, the agent received the internal error text (which can include server paths). It now receives a generic message with a correlation id; the detail is written to the plugin log.
* FIX: A2A (off by default): the maximum amount set for create_payment and tokenize_card was not applied. Amounts above it are now refused before any order is created.
* FIX (security): Redsys Manager app: an employee whose WordPress role was lowered to customer or subscriber kept their app profile, and with it access to orders and customer data. Their app profile is now removed when the role changes.
* FIX (security): The public discovery documents for AI agents (UCP /.well-known/ucp and the ACP well-known document) published the WordPress administrator's e-mail address. They now publish the address set in the new "Support e-mail for AI agents" setting, or none.
* FIX (security): A2A (off by default): the refund amount above which a store administrator must confirm ("sensitive threshold") was checked refund by refund, so splitting a refund avoided it. It now adds up what the same client refunded on the same order in the last 24 hours. HEADS-UP: a batch of small refunds on one order may now wait for your confirmation.
* FIX (security): A2A (off by default): a client's IP allow-list could be passed by sending an X-Forwarded-For header with an allowed address. The plugin now checks the connection's own address and believes X-Forwarded-For only from the proxies listed in the new "Trusted proxies" setting (A2A > Status). HEADS-UP: if your site sits behind a CDN or load balancer and an A2A client has an IP allow-list, add the CDN's addresses to that setting after updating, or the client will be refused.
* FIX (security): A2A (off by default): task streams ignored the client's rate limit, so one client could open enough of them to tie up the shop's PHP workers. Each stream now counts against the limit and a client can hold at most five at once.
* FIX (security): Switching A2A off in the settings did not stop clients that were already set up. With A2A off, its JSON-RPC endpoint and task streams now answer 503 and no push notification is sent.
* FIX (security): The Redsys bulk actions in the orders list (immediate charge, bulk refund, approve pre-authorization) now need the same permission as their single-order versions (manage WooCommerce) and only run while their setting is on.
* FIX (security): A2A (off by default): the push address an agent gives for task notifications could make the shop call its own server or internal network, even over plain http. It must now be https on port 443 of a public host, and notifications use WordPress's safe HTTP transport.
* FIX (security): ACP webhooks (off by default): a provider could register a webhook pointing at the shop's own server or internal network. A webhook URL must now be port 443 on a public host (a filter allows otherwise for development), webhooks registered earlier that break the rule are no longer called, and deliveries use WordPress's safe HTTP transport.
* FIX (security): UCP (off by default): the platform profile address an agent sends in its UCP-Agent header could make the shop call its own server or internal network. Only https addresses on port 443 of public hosts are fetched now, through WordPress's safe HTTP transport.
* FIX (security): UCP webhooks (off by default): a client could register a webhook pointing at the shop's own server or internal network, and a read-only token was enough. A webhook URL must now be https on port 443 to a public host, registering or deleting one needs the checkout write scope, webhooks registered earlier that break the rule are no longer called, and deliveries use WordPress's safe HTTP transport.
* FIX (security): UCP, MCP and A2A (off by default) accepted an OAuth refresh token as if it were an access token. Only access tokens open those routes now.
* FIX (security): Agentic checkouts (UCP and ACP, off by default): an AI agent could put on an order products the shop does not sell - drafts, private or out-of-stock products, variable or grouped parents. The order is now refused (422) and names the products.
* FIX (security): The plugin's "View details" window read the update server's answer with a function that can build PHP objects. It now reads that answer as plain data only.
* FIX (security): The checkout's 3-D Secure browser-data request could write that data onto any order number. It now writes only onto the visitor's own order and otherwise keeps it in their session.
* FIX (security): Agentic checkout (ACP, off by default): an order created by an AI agent was attached to any registered customer whose e-mail the agent sent. It now stays a guest order; stores that want the old behaviour can return true from the redsys_acp_link_order_to_customer_by_email filter.
* FIX: A failed or late payment notification (for example the "denied" result of an earlier attempt arriving after the order was paid) could cancel an order that was already paid - in Bizum and in the other Redsys payment methods. A paid order is now never cancelled by a notification; a note records what Redsys sent.
* FIX (security): One-click buy took the shipping cost and name from the browser, so a logged-in customer could pay less shipping (or none). The shipping is now recalculated by the store and must be one of the options the store offers; a product that needs shipping cannot be bought without it.
* FIX (security): Agentic catalogues (UCP catalog and ACP product feed, both off by default) listed draft and "Private products", and the UCP single-product lookup returned unpublished products. Agents now only see published products that are not private. A variation of a private product is private too.
* FIX (security): The Users-screen bulk actions "Request Redsys card" and PayGold did not check that the request came from that screen, so a page on another site could make a logged-in administrator send card-request e-mails (or PayGold operations) to arbitrary users. They now require the Users screen's security token and shop-manager rights. The PayGold handler also stops interfering with other plugins' bulk actions on that screen.
* FIX (security): Agentic checkout (ACP): revoking an access token did not clear its cached approval, so a revoked token kept working for up to five minutes. Revoking now takes effect immediately.
* FIX (security): Agentic checkout (ACP, off by default): access tokens generated as "Read only" were accepted for creating, changing and cancelling orders and managing webhooks. They are now read-only.
* FIX (security): Agentic checkout (ACP, off by default): a checkout session could be read, changed, completed or cancelled by any client that knew its id. Sessions now answer only the AI provider that created them.
* FIX (security): Agentic checkout (ACP, off by default): a client using a WooCommerce REST API key could claim to be another AI provider and read, delete or add that provider's webhooks. The provider is now taken only from the credential; bearer tokens registered in WooCommerce's agentic settings now resolve to their provider (so ACP webhooks work as intended), and a session with no provider no longer sends its events to every provider's webhooks.
* FIX (security): Agentic checkout (UCP, off by default): a checkout session could be read, changed, completed or cancelled by any client that knew its id, and the order endpoints skipped the owner check for a token with no user. Sessions now answer only the client and customer that created them, and a token with no user is refused.
* FIX (security): Agentic checkout (ACP, off by default): an agent could change the address and total of an order that was already paid, cancel it without a refund, or send it to the payment page again. Those requests are now refused (409) once the order is no longer open; a preauthorized order is voided from the store admin, not by an agent.
* FIX (security): Agentic checkout (UCP, off by default): an agent could still change the items and total of a checkout session after its order was paid, or cancel the paid order without a refund. A session whose order is paid, cancelled or failed can no longer be changed or cancelled.
* FIX: "Private products" (off by default) did not work: products marked private were only removed from the shop listing and could still be viewed and bought by anyone, and the list of allowed users was saved empty. A private product is now hidden (product page, Blocks/Store API) and cannot be bought by anyone outside its list; shop managers always see it. IMPORTANT if you use this option: open each private product and select its allowed users again - earlier versions lost those lists. A notice on the product screens reminds you.
* FIX (security): InSite on the Blocks checkout could attach another shopper's in-progress Redsys payment number to a new order, so that shopper's payment confirmation could land on the wrong order. A number that already belongs to another order is no longer attached.
* FIX (security): The "add payment method" redirect link answered anyone, and when given an order number it rewrote that order's terminal and key settings with the defaults (breaking later refunds on multi-terminal stores). It now only answers the logged-in customer who started adding the card, and never writes order data.
* FIX (security): The card payment notification set its "already processing" marker before checking the signature, so a forged request could make the store ignore Redsys's genuine notification for a minute and leave a paid order pending. The marker is now set only after the signature is valid.
* FIX (security): Manager app (off by default): a staff profile allowed to edit customers could also edit an administrator's account, including the e-mail, which is enough to take it over with a password reset. The app's customer screens now only load and edit customer accounts, never staff.
* FIX (security): Licence activation and update checks talked to plugins.joseconti.com without verifying its TLS certificate, and trusted whatever the reply said about which plugin to update and where to download it. TLS is now always verified, the update offered is always for this plugin, and the download must come over https from the licence server itself.
* FIX (security): E-mail payment fallback (IMAP/Gmail, off by default): an e-mail whose sender merely contained the Redsys address could mark a pending order as paid, and so could a real Redsys e-mail about a denied payment. Now the sender must be exactly the address set in the settings, and the e-mail must show an approved payment for the order's amount and merchant code; otherwise the order is left as it was and gets a note. If you entered only part of the Redsys address (or only the domain) in those settings, enter the full address.
* FIX (security): Removed an unused InSite REST address (woocommerce-redsys/v1/save_order_data) that let a request carrying only a matching Referer header change the Redsys order number stored on any order, which refunds rely on. The Blocks checkout has not used it since 31.0.4.
* FIX (security): Agentic checkout (UCP, off by default): an order created by an AI agent was attached to whichever registered customer owned the e-mail the agent sent, which also put that customer's saved cards within reach. The order now belongs to the customer who authorised the agent, and never to someone because of an e-mail address.
* FIX (security): Apple Pay express stored a temporary marker under a name taken from the browser, and that name could match the markers the plugin reads to confirm payments. Wallet markers (Apple Pay and Google Pay) now live under their own hashed names.
* FIX (security): Completes the saved-card fix above for the redirect payment page. The card chosen at checkout was also carried into the signed Redsys payment form without checking whose card it was. The form now uses a saved card only if it belongs to the customer paying; otherwise it asks for a new card (a new subscription card when the order has a subscription).
* FIX (security): Each order keeps the Redsys key it was paid with, so refunds and renewals keep working when several terminals are in use. WooCommerce's REST API returned that key to any integration with a read-only API key. It is no longer included in order or subscription REST responses; it is still stored and used exactly as before.
* FIX (security): With "Show the Redsys page inside the store" (iframe mode), and for every Bizum Checkout order, the return links printed an order's cancel and order-received addresses, with its private key, to anyone who asked, for as long as the store kept a marker that never expired. They now answer only the buyer who owns the order (the return links sent to Redsys carry the order key for that), and the marker expires after a day.
* FIX (security): A notification-endpoint link used by the retired 3-D Secure method step sent any visitor to the payment page of the order number in the link, including its private order key. It now only sends the buyer who owns the order there (card and InSite).
* FIX (security): The extra fields that Apple Pay and Google Pay express buttons ask for (NIF/DNI and similar) stored whatever field names the request carried, on the order and on the customer's account. They now store only the fields your store defines, and never the plugin's internal data. Shops that show express buttons should update.
* FIX (security): A saved card could be charged by someone it did not belong to. The card is identified in the checkout request by a row number, and the plugin did not check whose card it was, so a crafted request could charge another customer's saved card without the bank asking that customer to confirm anything. Every charge with a saved card now checks that the card belongs to the customer who is paying, and refuses the payment otherwise; a card id that does not exist no longer causes a fatal error. Shops that offer saved cards should update. Reported privately, with the cause already located, by a shop that chose to tell us first and publish nothing - thank you.
* FIX: In test mode, "Show to this users" limits a gateway to the users you pick. The Blocks checkout ignored it and showed the gateway to every visitor, guests included; the order was then rejected, so the customer saw a payment method that failed when pressed. Every gateway now applies the list in the Blocks checkout as well as the classic one. A developer filter, redsys_gateway_shown_to_user, can adjust the decision. Reported with the cause already located - thank you.
* FIX: Apple Pay and Google Pay (checkout) had the "Show to this users" field but never applied it, in any checkout. They now do.
* FIX: With Inespay, a user on the "Show to this users" list could still be hidden, because the saved list was compared the wrong way. Listed users now see it.
* FIX: With "Pay with One Click" from the product page active, the plugin added two headings - "Terms and Conditions" and "Select Shipping Method" - to every product page, even when nobody had opened those windows, which cluttered the page structure that search engines and accessibility tools read. Those windows are now built only when they are actually opened, and their title is no longer a heading: it names the window for screen readers instead, which the windows for terms and shipping did not do before. Nothing changes in what the customer sees. Reported by a shop that found it in its heading audit - thank you.
* FIX: The script and the styles of "Pay with One Click" from the product page loaded on every product page, including where the button never appears because the option is off or the visitor is not logged in. They now load only where the button does.
* NEW: The plugin license is now managed in WooCommerce > Settings > Redsys Advanced > General, at the top of the page, and no longer has its own entry in the WooCommerce menu. The license key, how it is activated and where it is stored do not change, and the old address still works: it takes you to the new place. The notice that asks for a license points there too.
  

View the full WooCommerce Redsys Gateway Changelog

(No Ratings Yet)

Loading...