ifthenpay | Payments for LatePoint

Security Report Card

Readiness

PHP Compatibility

Categories with Findings

Positive Observations

• Callback endpoint validates cheapest/most decisive checks first (params → token lookup → anti-phishing key → amount), returns empty bodies on rejection, and maps settlement outcomes to correct HTTP semantics for ifthenpay's retry engine.
• Browser-reported payment outcomes are never trusted: the polling path confirms every txid directly with ifthenpay (IfthenpayLpTransactionStatus::check()) and requires the confirmed order_id to equal the local token before reporting paid.
• Shared token-based locking (IfthenpayLpSettlementLock) between the inbound callback and the browser polling path prevents read-before-write races that could downgrade a paid row to CANCELLED — an explicitly designed, well-documented concurrency control rarely seen in WordPress payment plugins.
• Amount-mismatch guards run on both deferred (settle_payment) and realtime (settle_realtime_locked) settlement paths, with normalized formatting on both sides of the comparison.
• Invoice-based payments resolve via LatePoint's opaque access_key rather than the sequential invoice id, with a documented and verified TypeError workaround for a LatePoint core bug on non-matching keys — preventing enumeration of other customers' invoices.
• Fresh 20-character random token per checkout attempt (with explicit reasoning about LatePoint's order_intent reuse) prevents duplicate live payment links under a reused token and silently-failed UNIQUE inserts.
• Tools admin page enforces a capability check (OsRolesHelper::can_user('settings__edit')) at render AND re-checks capability plus check_admin_referer() on every POST action; all table output (tokens, names, emails, amounts, dates) is consistently escaped with esc_html/esc_attr/esc_url/esc_js.
• Checkout-time identity/booking snapshot (checkout_snapshot) deliberately avoids re-reading the reusable order_intent row later — a subtle data-integrity safeguard with documented reasoning.
• API client centralizes transport with typed exception hierarchy distinguishing credential failures (terminal) from transport failures (retryable), and callers fail open on settings pages but closed at checkout — the correct polarity.
• Backoffice key is encrypted at rest via LatePoint's encrypted-settings filter, and save-time validators reject confirmed-bad keys while failing open on transport errors.
• Sensitive settings page renders no configuration UI when no gateway keys exist, and error responses to anonymous customers never include exception messages on the payment-creation path.
• Consistent ABSPATH guards on every PHP file, consistent text domain, no SQL string interpolation visible in the audited files, and no direct superglobal use without sanitization (sanitize_text_field + wp_unslash used correctly throughout).
• Caching strategy is deliberate: short TTL plus immediate invalidation for merchant-editable gateway data, longer TTL for the global method catalog, and failures are never cached so outages self-heal.
• HTTPS-only endpoints; the Payshop class explicitly rejects a documented GET variant to avoid placing credentials in query strings, showing security-conscious API consumption.
• Settlement is single-funnel and idempotent: settle_payment() is the only mutation path, keyed by request_id under a cross-request GET_LOCK() mutex, with settled_at re-checked inside the lock and ALREADY_SETTLED returned on replays.
• Anti-replay token binding: settle_payment() rejects when the caller's expected_token does not match the record resolved from request_id, preventing a valid request_id from settling an unrelated booking.
• Constant-time credential comparison: IfthenpayLpCallbackParams::matches_gateway_key() uses strict base64_decode plus hash_equals() against the per-record gateway key — never a global setting, never decoded elsewhere.
• Amount integrity done right: amounts are compared as canonicalised strings via a single shared format_amount() implementation, explicitly avoiding float equality; missing payload amount fails closed.
• Expiry sweep/settlement race handled correctly: the sweep takes the same per-request_id lock, re-reads the row fresh inside it, and skips rows already settled — a payment landing mid-sweep always wins.
• Orders closed to settlement (cancelled, refunded, partially refunded) are explicitly rejected, so a late callback cannot resurrect a cancelled order.
• All SQL is parameterised; interpolated identifiers are only $wpdb->prefix-derived table names or LatePoint core constants, with accurate phpcs annotations explaining each case.
• Cache invalidation is thorough: update_columns() clears token, request_id, and intent_id cache entries, including the falsy-but-real request_id '0' edge case.
• Schema migrations are safe: dbDelta for upgrades, old table renamed to _legacy rather than dropped, schema version option prevents re-runs.
• Validity clamping prevents a payment reference from outliving the appointment it pays for, with a shared lead-time calculator so the checkout gate and the clamp can never disagree.
• Fail-open vs fail-closed choices are deliberate and documented: gateway-dataset outages fail open at checkout gating (availability), while credential validation and settlement fail closed (money movement) — the correct asymmetry.
• Webhook-relevant identifiers are honestly labelled: callback request_id is never presented as a 'transaction ID' in notes, avoiding merchant reconciliation confusion.
• Consistent, context-correct output escaping throughout: esc_html/esc_attr/esc_url used in the admin renderer, reference display, and both email templates, including escaping inside loops and on array-derived values.
• uninstall.php uses $wpdb->prepare() with $wpdb->esc_like() correctly for the LIKE-based transient cleanup — the exact correct pattern that scanners frequently false-positive.
• All PHP files carry an ABSPATH direct-access guard; uninstall.php correctly uses the WP_UNINSTALL_PLUGIN guard instead.
• The payment architecture is sound: pay-by-link means no card data touches the site, settlement is via signed server-to-server callbacks, and the client-side verification flow is explicitly designed as a hint-based poll against stored server state rather than trusting client parameters.
• Backoffice Key is rendered via a password field, and the JS preview flow never persists it — the actual save goes through LatePoint's own settings save.
• Single-escape discipline is deliberate and documented (raw values in the email items array, escaped exactly once at render), avoiding double-encoding.
• uninstall.php deliberately preserves the payment transactions table — the correct data-retention decision for settlement/audit records — while cleaning everything else including per-key transients that have no single known key.
• The booking-status warning feature shows genuine security/UX thought: it detects the double-booking risk when LatePoint's default booking status doesn't block timeslots for deferred payments.
• Client-side DOM construction uses jQuery .text() for account keys and only interpolates server-provided URLs into the iframe src, with a try/catch around cross-origin iframe access.
• Cron cleanup is present in uninstall.php with the same hook constant (IfthenpayLpExpirySweep::HOOK), so the scheduled expiry sweep is not orphaned.
• Text domain is consistent everywhere (ifthenpay-payments-for-latepoint) and matches the header; load_plugin_textdomain() is correctly called on init priority 0 with the right path.
• HTML is kept outside translation strings and sprintf() is used for interpolation (see the admin notices and the '%1$s on %2$s @ %3$s' booking summary) — RTL-safe and translator-friendly.
• All outbound HTTP goes through a single IfthenpayLpApiClient with an explicit timeout policy and a clean exception hierarchy; no bare wp_remote_get/post or file_get_contents anywhere.
• External calls and JSON decoding are consistently wrapped in try/catch with WP_Error / is_wp_error / is_array guards before use.
• Cron events are cleared on deactivation via wp_clear_scheduled_hook, and scheduling uses the idempotent wp_next_scheduled() guard so init() does not create duplicate events.
• No debug leftovers (no var_dump/print_r/error_log), no dynamic-property usage, no error suppression (@), and no PHP 8.1+/8.2 deprecated functions (utf8_encode, ${} interpolation) were found.
• Activation is idempotent (guarded scheduling, update_option, CREATE-or-migrate schema routine), and a db_version is tracked with an on-init upgrade path so in-place updates reach the same state as a fresh activation.
• Cache failures are deliberately not persisted (gateway dataset only sets the transient on success), so a transient ifthenpay outage self-heals on the next call.
• The admin tools page performs both a LatePoint capability check (settings__edit) and nonce verification on every mutating POST action.
• The plugin keeps its raw page output escaped (esc_html/esc_attr/esc_url/esc_js) and defers to WP core helpers (wp_nonce_field, submit_button, add_options_page, human_time_diff, OsMoneyHelper) rather than reinventing them.
• Payment/validation logic is consistently wrapped in try/catch for ifthenpay API calls (IfthenpayLpManualRecheck, deferred reference creation) and never lets an outage fatal the checkout.
• A cross-request mutex (IfthenpayLpSettlementLock) built on MySQL GET_LOCK() with a documented add_option() fallback serialises settlement against the expiry sweep, with careful reasoning for rejecting SELECT ... FOR UPDATE.
• Settlement is idempotent and two-phase; mark_settled() is written before latepoint_transaction_created fires so listeners read a PAID row.
• Null-safe JSON decoding (decode_json_column) explicitly accounts for the PHP 8.1 json_decode(null) deprecation.
• The upgrade path uses a versioned schema option plus dbDelta() with correctly formatted SQL, and migrates legacy data by rename-to-_legacy rather than dropping it.
• No debug output (var_dump/print_r/error_log), no @ error suppression, and no PII written to server logs were found.
• i18n is applied to the overwhelming majority of user-facing strings with a single consistent text domain, and date output correctly uses wp_date() in the agent digest.
• format_amount() deliberately uses number_format() (not number_format_i18n()) to keep the two-decimal '.' API payload locale-independent — the correct choice for a gateway payload.
• IP addresses are not logged, and checkout-time validation fails open on transport errors so an ifthenpay outage does not lock merchants out of their own settings or take checkout down.
• uninstall.php carries the mandatory `if ( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) { exit; }` guard and correctly clears the scheduled expiry-sweep hook plus every prefixed per-gateway transient using $wpdb->esc_like().
• Text domain is consistently 'ifthenpay-payments-for-latepoint' across every __()/esc_html__() call reviewed, with sprintf() used for interpolated strings ('Order: #%s', 'Pay by: %s', 'Default %1$d, accepts %2$d–%3$d') rather than concatenation.
• The front-end payment flow wraps its ajax request in try/catch and polls with a bounded loop (POLL_MAX_ATTEMPTS) returning a friendly timeout message instead of hanging, and the server response is checked before use.
• All customer/admin output in the renderers is escaped at the point of output (esc_html/esc_attr/esc_url), and the admin form's third-party helper calls carry explicit phpcs:ignore annotations documenting why the escaping is delegated.
• PHP 8 readiness is good: explicit nullable types, no dynamic properties, no deprecated string interpolation, no utf8_encode/decode; Requires PHP 7.4 matches the syntax used.
• readme.txt includes the required External Services disclosure (ifthenpay EULA/privacy links, exact API domains to allowlist, and the inbound callback URL), which meets the WordPress.org disclosure requirement for plugins making outbound connections.
• The uninstall docstring clearly explains why payment-history tables are retained, turning a potential reviewer complaint into a documented retention decision.
• Interactive controls in the Tools page are rendered as native <button>/submit_button elements, which are keyboard-accessible by default (Enter/Space fire click); no div/span-as-button anti-patterns were found.
• All dynamic output on the admin Tools page is escaped (esc_html, esc_attr, esc_url, esc_js) and the standalone notice markup in the main plugin file escapes its translated strings and URL.
• Table markup uses semantic <table>/<thead>/<tbody>/<th>/<td> structures rather than div grids, so row/column relationships are preserved for assistive technology.
• Heading hierarchy on the Tools page is coherent: a single <h1> page title followed by <h2> section headings (Callback URL, Outstanding Deferred Payments, Unclaimed Realtime Payments) with no skipped levels or duplicate h1.
• The confirmation prompt for the destructive Cancel action uses the native browser confirm() dialog, which is keyboard-operable and announced by assistive technology.
• No non-semantic interactive elements found: the audit set contains no div/span/li with click handlers, no role="button" on non-button elements, and no custom dropdown/modal/tab markup that would require keyboard handlers or ARIA roles.
• No ARIA misuse present — the provided classes render no HTML UI of their own (payment processing, settlement, repository, validation and expiry logic are pure backend), so there is no risk of incorrect role/aria-* attributes being emitted from these files.
• All customer- and merchant-facing strings are passed through WordPress translation functions (__, _n, esc_html__) with correct translator comments, supporting localisation of any UI text that does reach the browser or email.
• No hard-coded colour-plus-only state indicators: the lapsed-appointment digest deliberately does not change booking status and its email body is plain text (implode of newline-separated lines), which is maximally accessible in a mail client.
• IfthenpayLpLapsedAppointmentDigest uses wp_date() with the site's configured date_format/time_format, so dates/times respect the site locale rather than emitting a fixed, possibly ambiguous format.
• The email fallback wrapper (fallback_layout()) does not set an explicit foreground colour on either background, avoiding an accidental low-contrast text-on-tint combination.
• No focus-trapping overlays, no CSS hiding content from assistive tech, and no animation logic exist in these files, so the Phase 2 and Phase 4 anti-patterns cannot originate here.
• All `<img>` elements carry appropriate alt text: decorative method icons use `alt=""`, brand marks use `alt="ifthenpay"`, and the reference-box method mark uses the method name (`alt="Multibanco"`/`"Payshop"`).
• The email template uses `<table role="presentation">` so layout tables are correctly removed from the accessibility tree.
• The modal close button carries an accessible name (`aria-label="Close"`).
• Native `<button>` elements are used for Connect/Disconnect, and checkboxes are native inputs, so basic keyboard activation is inherited from the browser.
• Dynamic account-key updates use `.text()` and default-method changes toggle native `disabled`/`selected` states rather than removing options, keeping state changes discoverable.
• Output is consistently escaped (`esc_html`, `esc_attr`, `esc_url`) which keeps rendered text trustworthy for AT.
• Every outbound HTTP call is centralised in IfthenpayLpApiClient, which sets an explicit 'timeout' on every request (TIMEOUT_VALIDATION=5s, TIMEOUT_GENERAL=10s) — no bare wp_remote_get()/wp_remote_post() without a timeout anywhere.
• Remote responses are cached two ways: a per-request static array plus a transient (IfthenpayLpMethodCatalog 12h, IfthenpayLpGatewayDataset 1 min) with explicit invalidate() on save, and failures are deliberately NOT cached so a transient outage self-heals.
• The expiry sweep and the settlement path serialise on the same key via MySQL GET_LOCK() (session-scoped, auto-released on connection drop) rather than an explicit transaction, avoiding nested-transaction issues and never leaving a key jammed by a crashed process.
• The daily digest builds its message as an array of lines and implodes once, and the Multibanco key regex is a compiled class constant rather than recompiled per call.
• No unbounded get_posts()/WP_Query/WP_Query-without-no_found_rows patterns; the one raw SQL COUNT (foreign_process_exists) and the digest join query are one-time and use $wpdb->prepare with %s placeholders.
• Only one background job pair (hourly expiry sweep, daily digest) rather than per-request cron-scheduling in frontend hooks.
• The callback REST route is registered with permission_callback '__return_true' but validates cheaply (parameter presence, then an indexed token lookup, then a constant-time hash_equals of the anti-phishing key) before touching the lock — reordered so garbage traffic is rejected before any expensive work.