1.1.0

What's changed

• Security: postbacks no longer trust the posted status. The transaction is re-fetched from the Dragonpay API and its status is used. Before, anyone could post a "success" status and mark a payment completed.
• Security: the transaction id is now signed together with the amount, currency and order data, so a cheap checkout can't be redirected to pay for another order.
• The postback digest is still checked when Dragonpay sends it, and refused when no merchant password is configured.
• Completed payments are never moved back to pending, and amount mismatches are rejected.
• Checkouts whose order data is longer than Dragonpay's 80-character limit now fail with a clear message instead of losing the paid order.
• Postbacks are answered in the format Dragonpay expects, with an error when recording the payment fails so Dragonpay retries.
• Fixed a crash when the payment didn't exist yet.

1.0.1

Update plugin.json

1.0.0

first commit