Security hardening: the API endpoint can no longer be redirected via site settings (removes the "API Base URL" field). Also adds buyer-facing decline reasons, safer handling of wrong-amount payments and refunds. Recommended for all sites.<\/p>","1.0.3":"
Payment pages now show the real MTN\/Airtel logos by default (filter-overridable). Plugin credits also updated: Techdom Digital Solutions, Cipherwave Software Limited.<\/p>","1.0.2":"
"Powered by Shashura" is now opt-in (off by default); internal naming made more distinctive. No action needed unless you want the credit link, which you can now turn on in the payment settings.<\/p>","1.0.1":"
Plugin renamed to Shashura Mobile Money for CampTix; no functional changes.<\/p>","1.0.0":"
Initial release.<\/p>"},"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.2","1.0.3","1.0.4"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3773101,"resolution":"1","location":"assets","locale":"","width":1164,"height":1724},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3774399,"resolution":"2","location":"assets","locale":"","width":6472,"height":2644},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3774399,"resolution":"3","location":"assets","locale":"","width":1608,"height":2187}},"screenshots":{"1":"Payment configuration under CampTix \u2192 Setup \u2192 Payment: credentials, environment selection, and live connection status.","2":"The buyer-facing checkout flow, from entering a mobile number through to the CampTix ticket page.","3":"An optional \"Powered by Shashura\" footer, shown here on the PIN-approval step. Off by default; the site administrator can turn it on from the payment settings."}},"plugin_section":[],"plugin_tags":[37364,15609,141805,37360,289631],"plugin_category":[],"plugin_contributors":[289480,241048],"plugin_business_model":[],"class_list":["post-392628","plugin","type-plugin","status-publish","hentry","plugin_tags-airtel","plugin_tags-camptix","plugin_tags-mobile-money","plugin_tags-mtn","plugin_tags-shashura","plugin_contributors-cipherwave","plugin_contributors-ssebuwufumoses","plugin_committers-cipherwave"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/shashura-mobile-money-for-camptix.svg","icon_2x":false,"generated":true},"screenshots":[{"src":"https:\/\/ps.w.org\/shashura-mobile-money-for-camptix\/assets\/screenshot-1.png?rev=3773101","caption":"Payment configuration under CampTix \u2192 Setup \u2192 Payment: credentials, environment selection, and live connection status."},{"src":"https:\/\/ps.w.org\/shashura-mobile-money-for-camptix\/assets\/screenshot-2.png?rev=3774399","caption":"The buyer-facing checkout flow, from entering a mobile number through to the CampTix ticket page."},{"src":"https:\/\/ps.w.org\/shashura-mobile-money-for-camptix\/assets\/screenshot-3.png?rev=3774399","caption":"An optional \"Powered by Shashura\" footer, shown here on the PIN-approval step. Off by default; the site administrator can turn it on from the payment settings."}],"raw_content":"\n
Shashura Mobile Money for CampTix adds MTN and Airtel Mobile Money as a payment option for CampTix, the WordPress event ticketing plugin used by WordCamp and community events. It is built for organisers selling tickets in Uganda who need a payment method their attendees already use day to day. This plugin is developed and maintained by Techdom Digital Solutions and is not affiliated with, or endorsed by, the CampTix project.<\/p>\n\n
A Shashura merchant account is required to use this plugin. Sign up or log in at https:\/\/shashura.com<\/a>.<\/p>\n\n The plugin connects CampTix to the Shashura Mobile Money API and handles the full collection lifecycle: number verification, the PIN push to the buyer's phone, settlement confirmation, and reconciliation. It runs against either Shashura's Sandbox or Production environment, and endpoint overrides are controlled by trusted deployment code, never per-site settings. See ENDPOINT-POLICY.md for migration and development testing.<\/p>\n\n This plugin needs three values from your Shashura merchant account: a Client ID, a Client Secret, and a Webhook Secret. All three are issued from the Apps page of your Shashura merchant dashboard.<\/p>\n\n Because each app holds both a Sandbox and a Production credential pair, going live does not require creating a new app; only switching this plugin's Environment setting to Production and swapping in the Production Client ID and Secret from the same Apps page.<\/p>\n\n This plugin connects to the Shashura Mobile Money API to collect ticket payments. This is required functionality: without it, the plugin cannot verify mobile numbers, push PIN prompts, or confirm payment, since Mobile Money collection can only happen through a licensed Mobile Money aggregator.<\/p>\n\n What is sent, and when:<\/p>\n\n This service is provided by Shashura (operated by Techdom Digital Solutions): Terms of Service<\/a>, Privacy Policy<\/a>.<\/p>\n\n A Shashura merchant account, with an app's Client ID and Client Secret, is required to use this plugin. See \"Getting Your Shashura API Credentials\" above.<\/p>\n\n Shashura is a Mobile Money payment gateway for Uganda, settling payments through MTN and Airtel Mobile Money. A Shashura merchant account is required to use this plugin. Sign up or log in at https:\/\/shashura.com<\/a>.<\/p>\n\n Against each paid order, this plugin stores the payer's registered name, a masked mobile number, the mobile network, and the Shashura transaction reference, for reconciliation and support. Full, unmasked phone numbers and names are included in WordPress's own Tools \u2192 Export Personal Data and Erase Personal Data tools, so data-subject requests are handled through core WordPress, not a separate process. This plugin never handles or stores card numbers, mobile money PINs, or Shashura account credentials.<\/p>\n\n For help with a Shashura account, API credentials, or a specific payment, contact Shashura support through the merchant dashboard at https:\/\/shashura.com<\/a>. For issues with this plugin itself, use this plugin's support forum on WordPress.org.<\/p>\n\n An automated end-to-end suite (92 checks) has been run against WordPress with both current CampTix (2.x) and CampTix 1.4.x, covering the full payment lifecycle: KYC errors, underpayment, wrong reference, forged or replayed webhooks, double approval, telco rejection, token expiry, cancel races, concurrent webhook and browser settlement, the timeout sweep, rate limits, and privacy export\/erase. An independent security review of the code and a live test deployment was also carried out, with every finding fixed and covered by the test suite.<\/p>\n\n The following filters are available to adjust plugin behaviour from a theme or another plugin:<\/p>\n\n Uganda Shillings (UGX) only, matching Shashura's Mobile Money coverage.<\/p><\/dd>\n Yes. Use CampTix's own \"Refund\" button on the attendee screen \u2014 full, partial, and refund-all are all supported. Only the amount the organizer actually received is reversed; Shashura's processing fee is not refunded. The attendee gets the refunded amount back on the same phone number that paid.<\/p><\/dd>\n The payment still settles. Shashura's webhook, and CampTix's own timeout check on CampTix 2.x, both ask Shashura directly whether the order was paid, independently of whether the buyer's browser is still open.<\/p><\/dd>\n Avoid it. A prompt sent under one environment cannot be checked while the plugin is configured for the other. It stays in a waiting state, never shown as failed, until the environment is switched back.<\/p><\/dd>\n Open the attendee's edit screen under Tickets \u2192 Attendees. The CampTix log on that screen records every check, error, amount mismatch or duplicate-payment warning for that order.<\/p><\/dd>\n Yes. A trusted deployment operator can set SHASMOMO_BASE_URL or use shasmomo_base_url. Per-site URL settings are ignored. See ENDPOINT-POLICY.md.<\/p><\/dd>\n\n<\/dl>\n\n\nHow a payment works<\/h4>\n\n
\n
Reliability and safety<\/h4>\n\n
\n
Requirements<\/h4>\n\n
\n
Getting Your Shashura API Credentials<\/h3>\n\n
\n
\n
TID_<\/code>. Use this, with its matching Client Secret, while Environment is set to Sandbox in this plugin.<\/li>\nPID_<\/code>. Use this, with its matching Client Secret, once Environment is switched to Production.<\/li>\nwhsec_<\/code>) on the same Apps page and copy it into this plugin's Webhook Secret field.<\/li>\nExternal services<\/h3>\n\n
\n
Additional Information<\/h3>\n\n
About Shashura<\/h4>\n\n
Privacy<\/h4>\n\n
Support<\/h4>\n\n
Testing<\/h4>\n\n
Credits<\/h4>\n\n
\n
assets\/images<\/code> are trademarks of MTN and Airtel.<\/li>\n<\/ul>\n\nDeveloper Filters<\/h4>\n\n
\n
shasmomo_lookups_per_ip<\/code> (default 20): number verification checks allowed per visitor IP per hour.<\/li>\nshasmomo_lookups_alert<\/code> (default 300): site-wide number verification checks per hour that trigger an admin email.<\/li>\nshasmomo_client_ip<\/code>: overrides the IP address used for rate limiting.<\/li>\nshasmomo_accent_color<\/code> (default #1d4ed8): accent colour used on the payment pages.<\/li>\nshasmomo_http_timeout<\/code> (default 25): timeout, in seconds, for calls to the Shashura API.<\/li>\nshasmomo_base_url<\/code> (default https:\/\/shashura.com\/api\/v1): trusted deployment override requiring HTTPS and WordPress safe HTTP validation. Per-site endpoint settings are ignored.<\/li>\n<\/ul>\n\n\n\n
\n
\n
Which currencies are supported?<\/h3><\/dt>\n
Does this plugin process refunds?<\/h3><\/dt>\n
What happens if a buyer closes the browser tab after approving the PIN prompt?<\/h3><\/dt>\n
Can I switch between Sandbox and Production while orders are still open?<\/h3><\/dt>\n
Where do I see what happened on a specific order?<\/h3><\/dt>\n
Can this connect to a Shashura deployment other than the public default?<\/h3><\/dt>\n
1.0.4<\/h4>\n\n
\n
SHASMOMO_BASE_URL<\/code> constant in wp-config.php<\/code>), never by a site's saved settings \u2014 closing a path where a compromised or tampered settings save could have redirected API credentials to another server. All requests now go through WordPress's safe HTTP transport, which blocks requests to private\/internal network addresses.<\/li>\n1.0.3<\/h4>\n\n
\n
shasmomo_network_logo<\/code> filter.<\/li>\n1.0.2<\/h4>\n\n
\n
1.0.1<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n