Poslivo Payment Gateway for Tosla İşim

Changelog

1.2.8

• Fix WordPress Plugin Check translator-comment and output-escaping findings.
• Document justified raw signed-callback and API-secret handling for WPCS while keeping field-specific sanitization.
• Prevent settings validation errors from emitting HTML before WordPress admin headers are sent.

1.2.7

• Require a successful inquiry result before a signed bank decline can mark an order failed.
• Preserve all valid API password punctuation while removing invalid UTF-8 and control characters.
• Reject installment packages carrying malformed or non-success API result codes.
• Keep random entropy in every Tosla order reference and validate the hosted 3D form URL again before checkout.
• Align the main plugin filename with the WordPress.org slug and remove unpublished legacy option identifiers.
• Require an HTTPS WooCommerce checkout and generate the Tosla callback URL with HTTPS.
• Bound remote response text, installment package iteration and privacy-safe log fields to prevent oversized stored data.
• Reject malformed non-scalar operation codes and guard minor-unit conversion against numeric overflow.
• Add suggested Tosla İşim data-processing text to the WordPress privacy policy guide.
• Require both generic and bank response codes to indicate success when Tosla supplies both values.
• Run a server-to-server inquiry before finalizing a signed failure callback, preventing stale callback results from overriding an approved payment.
• Preserve the page total on order-pay installment requests when no cart session is available.
• Disable the gateway by default and strengthen cardholder, expiry and remote response validation.
• Harden malformed Tosla response handling to avoid PHP conversion warnings.
• Reject non-numeric API result codes instead of allowing PHP integer coercion to treat them as success.
• Reconcile unfinished 3D attempts before a retry to prevent delayed approvals from causing duplicate charges.
• Preserve the checkout total when installment lookup is unavailable and remove one-time failure tokens through a server-side redirect.

1.2.5

• Harden callback processing so invalid signatures cannot change order status and unsigned bank messages are ignored.
• Keep uncertain callback and inquiry results on hold for scheduled or manual verification instead of allowing duplicate payment attempts.
• Fix Checkout Blocks API method compatibility and require a valid classic checkout nonce outside Store API requests.
• Validate installment authorization server-side, use integer minor units for payment and refund amounts, and improve retry fee rollback.
• Improve asynchronous installment request handling, 3D form URL validation, transaction log integrity and cleanup.
• Synchronize plugin, readme and translation metadata versions.

1.2.4

• Read only the specific checkout and callback fields required by the gateway instead of processing complete request arrays.
• Use wp_safe_remote_post() and public HTTPS URL validation for merchant-configured API endpoints.
• Validate callback hash parameters defensively and compare callback hashes with hash_equals().
• Remove the bundled third-party card-formatting library and replace it with plugin-owned, isolated formatting code.
• Cache API credential verification briefly to prevent repeated checkout requests and correctly expose installment authorization to block checkout.
• Sanitize installment API responses and validate commission values before using or returning them.
• Prevent duplicate installment fee items when a customer retries payment.
• Add deactivation and uninstall cleanup for scheduled checks, settings and privacy-safe logs.
• Document the external Tosla İşim service, transmitted data and working HTML privacy URL.

1.2.3

• Replaced generic global identifiers, hooks, options and script handles with the unique poslivo_tosla_isim prefix.
• Replaced slow direct PDF links with the working Tosla İşim service registration page and clarified where applicable legal notices are shown.

1.2.2

• Renamed the independent product identity to Poslivo.

1.2.1

• Use the developer’s Eray Bektaş identity and website in the plugin metadata.

1.2.0

• Renamed the plugin and slug to make its independent status clear.
• Removed remote JavaScript loading and use WordPress script APIs for all plugin scripts.
• Removed the administrative success-notice suppression.

1.1.12

• Align the WordPress.org plugin slug and text domain.

1.1.11

• Check unfinished 3D Secure sessions after 30 minutes. Approved payments are completed; confirmed incomplete payments are cancelled with an order note. Temporary Tosla connection errors leave the order pending and are retried safely.

1.1.10

• Store the Tosla order reference when the test API returns a zero transaction identifier.

1.1.9

• Versioned Blocks checkout script so checkout updates are not held by browser caches.

1.1.8

• Fixed WooCommerce Blocks checkout visibility when a transient Tosla connection check is slow.

1.1.7

• Added full and partial refunds through the WooCommerce order edit screen.

1.1.6

• Added explicit checkout validation and documented security exceptions for the signed Tosla callback and WooCommerce core hooks.

1.1.5

• Improved output escaping, card validation and administrative settings security checks found by Plugin Check.

1.1.4

• Added privacy-safe transaction logs for the last seven days.
• Added Luhn and expiry-date validation for card numbers.
• Improved release metadata and asset versioning.