Title: dev's Replies - page 4 | WordPress.org --- # dev [ ](https://wordpress.org/support/users/devksec/) * [Profile](https://wordpress.org/support/users/devksec/) * [Topics Started](https://wordpress.org/support/users/devksec/topics/) * [Replies Created](https://wordpress.org/support/users/devksec/replies/) * [Reviews Written](https://wordpress.org/support/users/devksec/reviews/) * [Topics Replied To](https://wordpress.org/support/users/devksec/replied-to/) * [Engagements](https://wordpress.org/support/users/devksec/engagements/) * [Favorites](https://wordpress.org/support/users/devksec/favorites/) Search replies: ## Forum Replies Created Viewing 15 replies - 46 through 60 (of 264 total) [←](https://wordpress.org/support/users/devksec/replies/page/3/?output_format=md) [1](https://wordpress.org/support/users/devksec/replies/?output_format=md) [2](https://wordpress.org/support/users/devksec/replies/page/2/?output_format=md) [3](https://wordpress.org/support/users/devksec/replies/page/3/?output_format=md) 4 [5](https://wordpress.org/support/users/devksec/replies/page/5/?output_format=md)… [16](https://wordpress.org/support/users/devksec/replies/page/16/?output_format=md) [17](https://wordpress.org/support/users/devksec/replies/page/17/?output_format=md) [18](https://wordpress.org/support/users/devksec/replies/page/18/?output_format=md) [→](https://wordpress.org/support/users/devksec/replies/page/5/?output_format=md) * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[WPML Multilingual & Multicurrency for WooCommerce] WCFM Marketplace support](https://wordpress.org/support/topic/wcfm-marketplace-support/) * Thread Starter [dev](https://wordpress.org/support/users/devksec/) * (@devksec) * [1 year, 7 months ago](https://wordpress.org/support/topic/wcfm-marketplace-support/#post-18250008) * Thank you. * I couldn’t see the compatibility codes within WPMLs plugin. Is it native within WCFM or could you provide where the code is that controls compatibility? We want to check where its hooked into. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program - myCred] FeaturesUtil::declare_compatibility:](https://wordpress.org/support/topic/featuresutildeclare_compatibility/) * Thread Starter [dev](https://wordpress.org/support/users/devksec/) * (@devksec) * [1 year, 7 months ago](https://wordpress.org/support/topic/featuresutildeclare_compatibility/#post-18247930) * Hello, * This is within the debug.log, cause isn’t known at this time its the only provided information. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program - myCred] PHP Fatal error: Uncaught DivisionByZeroError: Division by zero in](https://wordpress.org/support/topic/php-fatal-error-uncaught-divisionbyzeroerror-division-by-zero-in/) * Thread Starter [dev](https://wordpress.org/support/users/devksec/) * (@devksec) * [1 year, 7 months ago](https://wordpress.org/support/topic/php-fatal-error-uncaught-divisionbyzeroerror-division-by-zero-in/#post-18243210) * Great, will test that out. * Will this fix be included in the next release? * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program - myCred] PHP Fatal error: Uncaught DivisionByZeroError: Division by zero in](https://wordpress.org/support/topic/php-fatal-error-uncaught-divisionbyzeroerror-division-by-zero-in/) * Thread Starter [dev](https://wordpress.org/support/users/devksec/) * (@devksec) * [1 year, 7 months ago](https://wordpress.org/support/topic/php-fatal-error-uncaught-divisionbyzeroerror-division-by-zero-in/#post-18232064) * Hello, * Version details are: WordPressPHP v 8.2.26Mycred Version 2.9Mycred Toolkit Version 1.1.0 LMS Pro 3.1.0  * This is only with the “Passing a Quiz (Tutor LMS)” hook when a student fails a test. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Yoast SEO - Advanced SEO with real-time guidance and built-in AI] Tutor LMS trainer pages](https://wordpress.org/support/topic/tutor-lms-trainer-pages/) * Thread Starter [dev](https://wordpress.org/support/users/devksec/) * (@devksec) * [1 year, 8 months ago](https://wordpress.org/support/topic/tutor-lms-trainer-pages/#post-18176784) * hello, * we have premium. This issue is due to a lack of compatibility as Yoast seems to have not included all of the correct features. * other tutor LMS members are reporting it * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Yoast SEO - Advanced SEO with real-time guidance and built-in AI] Tutor LMS trainer pages](https://wordpress.org/support/topic/tutor-lms-trainer-pages/) * Thread Starter [dev](https://wordpress.org/support/users/devksec/) * (@devksec) * [1 year, 8 months ago](https://wordpress.org/support/topic/tutor-lms-trainer-pages/#post-18167627) * Any update? * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Yoast SEO - Advanced SEO with real-time guidance and built-in AI] Product Category image showing on twitter link previews instead of product image](https://wordpress.org/support/topic/product-category-image-showing-on-twitter-link-previews-instead-of-product-image/) * Thread Starter [dev](https://wordpress.org/support/users/devksec/) * (@devksec) * [1 year, 8 months ago](https://wordpress.org/support/topic/product-category-image-showing-on-twitter-link-previews-instead-of-product-image/#post-18167625) * Yes it does and the latest premium & woocommerce bundle version. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Payment Gateway of Stripe for WooCommerce] Multiple stores order ID conflict causing unpaid orders to be marked as paid.](https://wordpress.org/support/topic/multiple-stores-order-id-conflict-causing-unpaid-orders-to-be-marked-as-paid/) * Thread Starter [dev](https://wordpress.org/support/users/devksec/) * (@devksec) * [1 year, 8 months ago](https://wordpress.org/support/topic/multiple-stores-order-id-conflict-causing-unpaid-orders-to-be-marked-as-paid/#post-18167422) * This is happening now, even with custom order pre-fix its marking orders back 5 months ago as paid for today due to the order numbers being the same on a different store. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[PDF Invoices & Packing Slips for WooCommerce] webp image support](https://wordpress.org/support/topic/webp-image-support-5/) * Thread Starter [dev](https://wordpress.org/support/users/devksec/) * (@devksec) * [1 year, 8 months ago](https://wordpress.org/support/topic/webp-image-support-5/#post-18155365) *  It does show webp image is supported under the status, so that doesn’t appear to be the cause. * It’s not possible to test on our store non .web images via the media library are all webp with a CDN redirect however the .webp images when hard coded into the template so doesn’t seem to be a webp issue. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[PDF Invoices & Packing Slips for WooCommerce] webp image support](https://wordpress.org/support/topic/webp-image-support-5/) * Thread Starter [dev](https://wordpress.org/support/users/devksec/) * (@devksec) * [1 year, 8 months ago](https://wordpress.org/support/topic/webp-image-support-5/#post-18154746) * Hello, * In test mode and the preview, the store logo does not show at all and the error is within the logs. Only when the image is hardcoded does it show. * Using simple template does not work either. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[PDF Invoices & Packing Slips for WooCommerce] webp image support](https://wordpress.org/support/topic/webp-image-support-5/) * Thread Starter [dev](https://wordpress.org/support/users/devksec/) * (@devksec) * [1 year, 8 months ago](https://wordpress.org/support/topic/webp-image-support-5/#post-18154539) * Specifically, this code is having to be replaced with an img tag to resolve it. We’ve not changed our logo in sometime or made any changes. * ```wp-block-code has_header_logo() ) { do_action( 'wpo_wcpdf_before_shop_logo', $this->get_type(), $this->order ); $this->header_logo(); do_action( 'wpo_wcpdf_after_shop_logo', $this->get_type(), $this->order ); } else { $this->title(); } ?> ``` * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[PDF Invoices & Packing Slips for WooCommerce] webp image support](https://wordpress.org/support/topic/webp-image-support-5/) * Thread Starter [dev](https://wordpress.org/support/users/devksec/) * (@devksec) * [1 year, 8 months ago](https://wordpress.org/support/topic/webp-image-support-5/#post-18154529) * Hello, * We’re using pro v2.15.11 however our logo has disappeared from our invoices ( unsure to when). It does show webp image is supported under the status, so that doesn’t appear to be the cause. The logs show a critical error and header image not found (**Critical** Header logo file not found.). However encoding a .png image URL into a template works.On review, also adding manually a .webp image also works, so its the logo via the “Shop header/logo” under general settings which doesn’t seem to work with the simple premium template theme. - This reply was modified 1 year, 8 months ago by [dev](https://wordpress.org/support/users/devksec/). * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Payment Gateway of Stripe for WooCommerce] Klarna causing double stock deductions](https://wordpress.org/support/topic/klarna-causing-double-stock-deductions/) * Thread Starter [dev](https://wordpress.org/support/users/devksec/) * (@devksec) * [1 year, 8 months ago](https://wordpress.org/support/topic/klarna-causing-double-stock-deductions/#post-18154112) * Looks like its been happening since July, so one of the following updates has most likely caused it: v3.9.10 or v3.9.9 * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Payment Gateway of Stripe for WooCommerce] Multiple stores order ID conflict causing unpaid orders to be marked as paid.](https://wordpress.org/support/topic/multiple-stores-order-id-conflict-causing-unpaid-orders-to-be-marked-as-paid/) * Thread Starter [dev](https://wordpress.org/support/users/devksec/) * (@devksec) * [1 year, 8 months ago](https://wordpress.org/support/topic/multiple-stores-order-id-conflict-causing-unpaid-orders-to-be-marked-as-paid/#post-18150168) * Pretty sure its down to only using orderIDs for validation, which if within the same stripe account and matching would cause a webhook to trigger another orders payment status. * I dont think this is limited to stripe checkout, as a few payment methods have the same potential issue. class-stripe-checkout.php * /** * creates order after checkout session is completed.* [@since](https://wordpress.org/support/users/since/) 3.3.4*/public function eh_spg_stripe_checkout_order_callback() { * ```wp-block-code if(!EH_Helper_Class::verify_nonce(EH_STRIPE_PLUGIN_NAME, 'eh_checkout_nonce')) { die(_e('Access Denied', 'payment-gateway-stripe-and-woocommerce-integration')); } $order_id = intval( $_GET['order_id'] ); $order = wc_get_order($order_id); if(isset($_REQUEST['action']) && 'cancel_checkout' === sanitize_text_field($_REQUEST['action'])){ wc_add_notice(__('You have cancelled Stripe Checkout Session. Please try to process your order again.', 'payment-gateway-stripe-and-woocommerce-integration'), 'notice'); wp_redirect(wc_get_checkout_url()); exit; } else{ $session_id = sanitize_text_field( $_GET['sessionid'] ); $obj = new EH_Stripe_Payment(); $order_time = date('Y-m-d H:i:s', time() + get_option('gmt_offset') * 3600); $session = \Stripe\Checkout\Session::retrieve($session_id); $payment_intent_id = $session->payment_intent; EH_Helper_Class::wt_stripe_order_db_operations($order_id, $order, 'add', '_eh_stripe_payment_intent', $payment_intent_id, false); $payment_intent = \Stripe\PaymentIntent::retrieve($payment_intent_id); $charge_details = $payment_intent->charges['data']; foreach($charge_details as $charge){ $charge_response = $charge; } $data = $obj->make_charge_params($charge_response, $order_id); if ($charge_response->paid == true) { if($charge_response->captured == true){ $order->payment_complete($data['id']); } if (!$charge_response->captured) { $order->update_status('on-hold'); } $order->set_transaction_id( $data['transaction_id'] ); $order->add_order_note(__('Payment Status : ', 'payment-gateway-stripe-and-woocommerce-integration') . ucfirst($data['status']) . ' [ ' . $order_time . ' ] . ' . __('Source : ', 'payment-gateway-stripe-and-woocommerce-integration') . $data['source_type'] . '. ' . __('Charge Status :', 'payment-gateway-stripe-and-woocommerce-integration') . $data['captured'] . (is_null($data['transaction_id']) ? '' : '.'.__('Transaction ID : ','payment-gateway-stripe-and-woocommerce-integration') . $data['transaction_id'])); WC()->cart->empty_cart(); EH_Helper_Class::wt_stripe_order_db_operations($order_id, $order, 'add', '_eh_stripe_payment_charge', $data, false); EH_Stripe_Log::log_update('live', $data, get_bloginfo('blogname') . ' - Charge - Order #' . $order_id); // Return thank you page redirect. $result = array( 'result' => 'success', 'redirect' => $obj->get_return_url($order), ); wp_safe_redirect($result['redirect']); exit; } else { wc_add_notice($data['status'], $notice_type = 'error'); EH_Stripe_Log::log_update('dead', $charge_response, get_bloginfo('blogname') . ' - Charge - Order #' . $order_id); } } } ``` * A few concerns raised from initial checks: 1. Order ID Handling – The code relies on $_GET[‘order_id’] to retrieve the order ID and assumes it uniquely identifies an order. If two stores accidentally share the same `order_id` (e.g., both stores start order numbers at 1 or have overlapping ranges), a webhook sent to one store could inadvertently match an order in another store when sharing the same stripe account. 2. The session ID ($_GET[‘sessionid’]) is retrieved and used to fetch the Stripe Checkout session: php. Stripe webhooks should include additional validation, such as verifying the metadata or client_reference_id to ensure the webhook corresponds to the correct store and order 3. No Cross-Store Verification – The code does not validate whether the order_id or session ID belongs to the current store. It directly assumes the provided order_id is valid and related to the webhook payload. This could allow a Stripe webhook from another store (with a matching order_id) to mark an unrelated order as paid. 4. The code marks the order as paid when $charge_response->paid and $charge_response- >captured are true. Without additional checks to validate that the `order_id` and payment intent belong to the current store, this could inadvertently mark an unrelated order as paid. 5. Stripe webhooks require the validation of their signature (`Stripe-Signature` header) to ensure the request came from Stripe and corresponds to the correct environment. The code snippet does not show any validation of this header, which might leave the endpoint vulnerable to spoofed requests. * Go to with GBTs review/recommendations: * Recommendations for Mitigation 1. **Verify Order Ownership:** Add additional checks to ensure the order ID and session ID belong to the current store. For example: 2. - Compare the store’s URL or a unique identifier in the order metadata or webhook payload. - Use `metadata` fields in Stripe sessions to include the store ID or environment details. 3. **Validate Stripe Webhook Signature:** Use the `\Stripe\Webhook::constructEvent()` method to validate the `Stripe-Signature` header and ensure the payload belongs to the current store. 4. **Check Payment Intent Metadata:** Use `metadata` in the Stripe session or payment intent to uniquely link the payment to the specific store and order. This allows you to validate the incoming webhook against the store’s data. * One thing we’ve done as a temp measure is to have custom prefixes in for each stores order IDs, so they won’t clash anymore. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Payment Gateway of Stripe for WooCommerce] Multiple stores order ID conflict causing unpaid orders to be marked as paid.](https://wordpress.org/support/topic/multiple-stores-order-id-conflict-causing-unpaid-orders-to-be-marked-as-paid/) * Thread Starter [dev](https://wordpress.org/support/users/devksec/) * (@devksec) * [1 year, 9 months ago](https://wordpress.org/support/topic/multiple-stores-order-id-conflict-causing-unpaid-orders-to-be-marked-as-paid/#post-18146071) * Bits to review in the meantime: Order 1 (Failed) was in July 2024Order 2 (Success) 15th Nov 2024Order 1 had this added and the order went from failed to processing due to the matching order ID. The txn_ is for order 2. Payment Status : Succeeded[ 2024-11-15 20:33:04 ] . Source : card. Charge Status :Captured. Transaction ID: txn_3QLWCLI<>. via webhookPayment Status : Succeeded [ 2024-11-15 20: 33:04 ] . Source : mastercard( credit ). Charge Status :Captured.Transaction ID : txn_3QLWCLI<>There’s only logs to the order 2 and not to the orginal failed payment in July. Viewing 15 replies - 46 through 60 (of 264 total) [←](https://wordpress.org/support/users/devksec/replies/page/3/?output_format=md) [1](https://wordpress.org/support/users/devksec/replies/?output_format=md) [2](https://wordpress.org/support/users/devksec/replies/page/2/?output_format=md) [3](https://wordpress.org/support/users/devksec/replies/page/3/?output_format=md) 4 [5](https://wordpress.org/support/users/devksec/replies/page/5/?output_format=md)… [16](https://wordpress.org/support/users/devksec/replies/page/16/?output_format=md) [17](https://wordpress.org/support/users/devksec/replies/page/17/?output_format=md) [18](https://wordpress.org/support/users/devksec/replies/page/18/?output_format=md) [→](https://wordpress.org/support/users/devksec/replies/page/5/?output_format=md)