Skip to content

v1.1.0 - Security update: server-side payment verification

Choose a tag to compare

View all tags
@northmz northmz released this 10 Aug 18:49
· 2 commits to main since this release
v1.1.0
b4d94eb

⚠️ Security release — update as soon as possible

This release fixes a vulnerability that allowed invoices to be marked
paid without a completed payment. All previous versions are affected,
including v1.0.1. Every WHMCS store using this gateway should update.

Full technical details will be published in a security advisory once
merchants have had time to upgrade.

Required after updating

  1. Upload both files, replacing the existing ones:
    • modules/gateways/paymento.php
    • modules/gateways/callback/paymento.php
  2. Go to Setup → Payment Gateways → Manage Existing Gateways, then
    Save Changes on Paymento — even if you change nothing.

Step 2 is required, not optional. It re-registers your IPN URL with
Paymento. If your WHMCS is installed in a subdirectory, the URL
registered by earlier versions was wrong and payment notifications were
never reaching your store.

Note: the gateway will now refuse to save unless both the API Key and
the Secret Key are filled in. The Secret Key is what authenticates
payment notifications — a blank one is why some stores silently
received none.

Security

  • Invoice settlement now requires confirmation from the Paymento API.
    Payment status is no longer taken from request parameters.
  • Payments are bound to the invoice they were created for, so a token
    for one invoice cannot settle another.
  • The credited amount comes from the verified API response and is never
    left blank.
  • Duplicate and replayed notifications can no longer credit an invoice
    more than once.
  • Invoices placed through other gateways are no longer touched.
  • cURL requests now set explicit timeouts and TLS certificate
    verification.

Fixed

  • Payment notifications were rejected on some servers. The IPN
    signature header was matched against two hardcoded spellings;
    getallheaders() normalises header case differently depending on the
    PHP SAPI, so valid notifications failed on Apache mod_php. Now matched
    case-insensitively.
  • IPN URL was wrong on subdirectory installs. It was built from
    $_SERVER['HTTP_HOST'] assuming the document root. Now derived from
    your configured SystemURL.
  • Invoice lookups could fail outright on some WHMCS versions due to
    a column that does not exist in every schema.
  • A late or replayed rejection could move a paid invoice back to unpaid.

Changed

  • Every callback outcome is now recorded in Billing → Gateway Log,
    including the underlying error when something fails. If you are
    troubleshooting, start there — an empty log means the request never
    reached your store.
  • The customer return page distinguishes "paid" from "payment received,
    awaiting confirmation" instead of implying success either way.

Requires: WHMCS 7.0+, PHP 7.2+

Assets 2
Loading