Fix: gateway scripts/styles no longer enqueue on checkout when the payment method is disabled — previously every enabled AND disabled Solidgate gateway’s JS/CSS loaded on every checkout page load.
1.0.8
Fix: Card payment form no longer fails to render on checkout — rest_init_payment()/rest_update_payment() now force-load the WooCommerce cart/session (wc_load_cart()) before reading WC()->cart, since custom REST routes don’t get it auto-initialised the way WooCommerce’s own Store API does. Previously every init request 400’d with a false “Cart is empty” and the card iframe never mounted.
1.0.7
Fix: order_description/order_id/customer_email fixes documented in 1.0.6 are now actually applied in code (see 1.0.6 entry below).
1.0.6
Fixed: order_description is now built from WooCommerce cart item names instead of a generic label, making orders identifiable in the Solidgate dashboard.
Fixed: All string fields are clamped to their API maximum before submission (order_description → 255 chars, order_id → 255 chars, customer_email → 100 chars) — prevents error 2.01 length validation failures.
1.0.5
Security: webhook routing now extracts the order_id prefix from the raw request body via regex rather than from parsed JSON, eliminating the possibility of routing decisions being influenced by attacker-controlled input before signature verification.
Security: APM webhook handlers (MB WAY, BLIK, Bizum, iDEAL, Open Banking) now deduplicate by Solidgate event-ID using a transient, the same guard already in place for the Card webhook handler. Duplicate webhook retries from Solidgate are acknowledged and discarded without re-processing.
Security: card payment init token is now bound to the WC session customer ID. A token created in one browser session cannot be replayed by a different session.
1.0.4
Fix: Hub-initiated refunds (via Solidgate dashboard) now correctly create a WC refund record — previously the order status flipped to “refunded” but no refund amount was recorded in WooCommerce accounting or order history.
Fix: Added duplicate refund submission guard for BLIK, Bizum, iDEAL, and Open Banking — submitting a second refund while one is already awaiting webhook confirmation now returns an error instead of sending a second API call.
Fix: Duplicate webhook protection for Hub-initiated refunds via _sg_processed_refund_ids order meta — a second webhook for the same refund transaction no longer creates a duplicate WC refund record.
1.0.3
Security: card payment init and update endpoints now always read amount/currency from the server-side WC cart — client-provided values are ignored to prevent price manipulation.
1.0.2
Renamed plugin display name to “Solidgate Card Payments and Other for WooCommerce”.
1.0.1
Security: poll-status REST endpoints now require order_key for order enumeration protection.
