* SECURITY: Removed debug code from the PayPal IPN Handler script tha…

…t was causing invalid IPN requests to process as if they were valid. (Thanks, Francois Harvey)
strangerstudios · Oct 9, 2015 · 5c19c9b · 5c19c9b
1 parent 0423094
commit 5c19c9b
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/readme.txt b/readme.txt
@@ -116,6 +116,7 @@ Not sure? You can find out by doing a bit a research.
 
 == Changelog ==
 = 1.8.6.1 =
+* SECURITY: Removed debug code from the PayPal IPN Handler script that was causing invalid IPN requests to process as if they were valid. (Thanks, Francois Harvey)
 * BUG: Stripe supports daily recurring subscriptions. Fixed issue where PMPro was still throwing a warning in some cases.
 * BUG: Removed warnings in the membership stats report.
 * CODE: Changed a couple instances of "since v2.0" to "since v1.8".

diff --git a/services/ipnhandler.php b/services/ipnhandler.php
@@ -393,7 +393,7 @@ function pmpro_ipnValidate()
 			ipnlog("FP!");
 
 			$res = wp_remote_retrieve_body($fp);
-			if(strcmp($res, "VERIFIED") == 0 || true)
+			if(strcmp($res, "VERIFIED") == 0)
 			{
 				//all good so far
 				ipnlog("VERIFIED");