Security release. Merchant PEM moved to a random filename with chmod 0600 and dual .htaccess+index.php protection ; certificate password now encrypted at rest with authenticated encryption ; TWINT return signature expires after 30 min. Merchants should re-open the wizard and re-save their password (and optionally re-upload the p12) to benefit from the new cert filename immediately \u2014 the plugin also keeps working seamlessly with legacy stored values until they do.<\/p>","1.2.0":"
Adds the \u00ab Commande \u00bb wizard tab (unified Pay4All Shop + WooCommerce post-payment status configuration), lets the plugin boot standalone without Pay4All Shop, and wires a Pay4All Pro shortcut. No config change, no manual action.<\/p>","1.1.0":"
Rewrites the TWINT SOAP client in non-WSDL mode (no Initial release on WordPress.org. Free, no license, no domain activation.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3608678,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3608678,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3608289,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3608289,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.1.0","1.2.0","1.3.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3608289,"resolution":"1","location":"assets","locale":"","width":1152,"height":1723},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3608289,"resolution":"2","location":"assets","locale":"","width":1167,"height":1574},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3608289,"resolution":"3","location":"assets","locale":"","width":1168,"height":1139},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3608289,"resolution":"4","location":"assets","locale":"","width":1123,"height":1847},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3608289,"resolution":"5","location":"assets","locale":"","width":1138,"height":1504}},"screenshots":{"1":"Setup wizard, tab \u00ab Pr\u00e9paration \u00bb : the merchant is walked through the TWINT portal signup, store creation and certificate generation before any credential is asked for.","2":"Setup wizard, tab \u00ab Identification \u00bb : the merchant pastes the store UID \/ cash-register ID and uploads the .p12 certificate + password ; the plugin auto-converts to PEM and runs the connection test.","3":"Setup wizard, tab \u00ab \u00c9tat \u00bb : the \u00ab Connect\u00e9 \u00e0 TWINT \u00bb card confirms the last test result and lets the merchant re-run the connection test at any time.","4":"WooCommerce sub-menu \u00ab Configurer TWINT pour WooCommerce \u00bb : shortcut to the WooCommerce gateway settings when Pay4All Pro is installed alongside this plugin.","5":"Pay4All Shop payment methods : TWINT appears as an activable payment method on the free Pay4All Shop plugin's checkout method picker."}},"plugin_section":[],"plugin_tags":[1890,271599,507,9090,193458],"plugin_category":[45],"plugin_contributors":[268195],"plugin_business_model":[],"class_list":["post-337135","plugin","type-plugin","status-publish","hentry","plugin_tags-gateway","plugin_tags-pay4all","plugin_tags-payment","plugin_tags-switzerland","plugin_tags-twint","plugin_category-ecommerce","plugin_contributors-pay4all","plugin_committers-pay4all"],"banners":{"banner":"https:\/\/ps.w.org\/pay4all-for-twint\/assets\/banner-772x250.png?rev=3608289","banner_2x":"https:\/\/ps.w.org\/pay4all-for-twint\/assets\/banner-1544x500.png?rev=3608289","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/pay4all-for-twint\/assets\/icon-128x128.png?rev=3608678","icon_2x":"https:\/\/ps.w.org\/pay4all-for-twint\/assets\/icon-256x256.png?rev=3608678","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/pay4all-for-twint\/assets\/screenshot-1.png?rev=3608289","caption":"Setup wizard, tab \u00ab Pr\u00e9paration \u00bb : the merchant is walked through the TWINT portal signup, store creation and certificate generation before any credential is asked for."},{"src":"https:\/\/ps.w.org\/pay4all-for-twint\/assets\/screenshot-2.png?rev=3608289","caption":"Setup wizard, tab \u00ab Identification \u00bb : the merchant pastes the store UID \/ cash-register ID and uploads the .p12 certificate + password ; the plugin auto-converts to PEM and runs the connection test."},{"src":"https:\/\/ps.w.org\/pay4all-for-twint\/assets\/screenshot-3.png?rev=3608289","caption":"Setup wizard, tab \u00ab \u00c9tat \u00bb : the \u00ab Connect\u00e9 \u00e0 TWINT \u00bb card confirms the last test result and lets the merchant re-run the connection test at any time."},{"src":"https:\/\/ps.w.org\/pay4all-for-twint\/assets\/screenshot-4.png?rev=3608289","caption":"WooCommerce sub-menu \u00ab Configurer TWINT pour WooCommerce \u00bb : shortcut to the WooCommerce gateway settings when Pay4All Pro is installed alongside this plugin."},{"src":"https:\/\/ps.w.org\/pay4all-for-twint\/assets\/screenshot-5.png?rev=3608289","caption":"Pay4All Shop payment methods : TWINT appears as an activable payment method on the free Pay4All Shop plugin's checkout method picker."}],"raw_content":"\n Pay4All for TWINT adds TWINT as a payment method to the free Pay4All Shop plugin (order-form-based checkouts).<\/p>\n\n TWINT is a trademark of TWINT AG (Switzerland). This plugin is an independent integration and is not affiliated with, endorsed by, or sponsored by TWINT AG.<\/p>\n\n Main features:<\/p>\n\n To use this plugin you need:<\/p>\n\n There is no license fee, no subscription, no domain activation. Install, activate, run the wizard, done.<\/p>\n\n The WooCommerce payment-gateway integration (classic checkout, Checkout Blocks, HPOS, refunds, background monitoring) is not shipped inside this free plugin. It lives inside the paid companion \u00ab Pay4All Pro \u00bb, distributed outside WordPress.org from https:\/\/pay4all.ch\/. Install Pay4All Pro next to this plugin to enable the WooCommerce TWINT gateway.<\/p>\n\n This plugin connects to the TWINT merchant SOAP API (operated by TWINT AG) to authorize, capture, refund and reconcile payments. Without a valid TWINT merchant account and certificate, the gateway cannot process payments.<\/p>\n\n What it is used for<\/strong><\/p>\n\n What data is sent, and when<\/strong><\/p>\n\n Where the data is sent<\/strong><\/p>\n\n The plugin talks to one of three TWINT-owned endpoints depending on your Terms of use and privacy policy for TWINT<\/strong><\/p>\n\n No other external service is contacted by this plugin.<\/p>\n\n The complete, non-minified source of this plugin is bundled inside the ZIP itself. Every PHP file is human-readable and directly editable. The JavaScript bundles under No compiler, transpiler or bundler is required to work on this plugin.<\/p>\n\n\n Server requirements:<\/p>\n\n No. Pay4All Shop is a required companion \u2014 the wizard shows a warning when the companion is missing. Install both plugins together.<\/p><\/dd>\n Not directly. The WooCommerce TWINT gateway is packaged in the paid \u00ab Pay4All Pro \u00bb add-on, distributed from https:\/\/pay4all.ch\/. That add-on installs on top of this free plugin and wires the WooCommerce checkout, Checkout Blocks, HPOS compatibility and background monitoring.<\/p><\/dd>\n Log in to https:\/\/portal.twint.ch, create a store and generate a certificate. The wizard asks for the store UID, certificate password, cash-register ID and the certificate file.<\/p><\/dd>\n No. This plugin is fully free and works standalone (with Pay4All Shop). You only need TWINT merchant credentials.<\/p><\/dd>\n Not in this version. Activate the plugin site by site.<\/p><\/dd>\n\n<\/dl>\n\n\n.xml<\/code> schema files shipped) and stops logging SOAP request\/response payloads. No config change, no manual action.<\/p>","1.0.0":"\n
\n
WooCommerce support<\/h4>\n\n
External services<\/h3>\n\n
\n
\n
T4A_ENVIRONMENT<\/code> setting:<\/p>\n\n\n
https:\/\/service.twint.ch\/merchant\/service\/TWINTMerchantServiceV8_4<\/code><\/li>\nhttps:\/\/service-int.twint.ch\/merchant\/service\/TWINTMerchantServiceV8_4<\/code><\/li>\nhttps:\/\/service-pat.twint.ch\/merchant\/service\/TWINTMerchantServiceV8_4<\/code><\/li>\n<\/ul>\n\n\n
Source code<\/h3>\n\n
assets\/js\/<\/code> are shipped in a pretty-printed, non-minified form so you can read and modify them without a build step.<\/p>\n\n\n
pay4all-for-twint<\/code> folder to \/wp-content\/plugins\/<\/code> (or install the ZIP from Plugins > Add New).<\/li>\n\n
openssl<\/code>, soap<\/code>, curl<\/code>.<\/li>\n\n
Does the plugin work without Pay4All Shop?<\/h3><\/dt>\n
Does the plugin work with WooCommerce?<\/h3><\/dt>\n
Where do I find my TWINT credentials?<\/h3><\/dt>\n
Do I need a Pay4All account or license?<\/h3><\/dt>\n
Is WordPress Multisite supported?<\/h3><\/dt>\n
1.3.0<\/h4>\n\n
\n
wp-content\/uploads\/t4a_twint\/twint.pem<\/code> \u2014 a fixed, guessable path protected only by .htaccess deny from all<\/code>. On nginx (which silently ignores .htaccess<\/code>) or Apache with AllowOverride None<\/code>, the file was directly downloadable. Each merchant now gets a random 48-hex filename minted per install (stored in t4a_twint_settings_certfile<\/code>), the containing folder ships both an index.php<\/code> and an .htaccess<\/code> (belt-and-suspenders), and the file is chmod'd to 0600. Certificate renewal via TWINT backoffice also mints a fresh name, so a previously exposed URL is invalidated.<\/li>\nwp_options<\/code> and re-emitted in the wizard HTML + AJAX response + parsing error message. It is now stored encrypted via authenticated encryption (see below), never echoed back to the DOM (the field renders empty with a \u00ab laissez vide pour conserver \u00bb hint), and the \u00ab Failed to parse certificate \u00bb error no longer includes the provided password.<\/li>\nCipher<\/code> was AES-256-CTR with a length-checked salt suffix \u2014 malleable, no MAC, key material was LOGGED_IN_KEY<\/code> used raw. Replaced with sodium_crypto_secretbox<\/code> (XChaCha20-Poly1305) with an openssl aes-256-gcm<\/code> fallback, keyed via HKDF-SHA256 from LOGGED_IN_KEY + LOGGED_IN_SALT<\/code>. Ciphertexts written by earlier versions keep decrypting (backward-compatible reader) so no data loss.<\/li>\nt=1<\/code>, meaning it was replayable indefinitely. It now embeds the real timestamp and rejects any URL older than T4A_REDIRECT_SIGNATURE_EXPIRATION<\/code> (bumped from 60 s to 30 min so realistic TWINT-app flows are not rejected).<\/li>\nFileServer<\/code> defense-in-depth.<\/strong> Internal basename()<\/code> + type whitelist + realpath<\/code> bounding are now enforced inside send_file()<\/code> \/ display_pdf()<\/code>, in addition to the callers' existing sanitisation. Any request that escapes the allowed upload directory returns HTTP 404.<\/li>\nt4a_twint\/<\/code>, logs\/<\/code>, temp\/<\/code>, locks\/<\/code> now systematically ship both .htaccess<\/code> and an empty index.php<\/code> so servers that ignore .htaccess<\/code> still can't list or serve them.<\/li>\nEnvironmentConfig::get_certificate_file_path()<\/code> is resolved LIVE (not from the T4A_CERTIFICATE_PATH<\/code> constant frozen at boot) so a cert upload followed by a connection test in the same request reads the just-written file. Same for the certificate password \u2014 the SoapClient reads it via get_certificate_password()<\/code> instead of stripcslashes(get_option(...))<\/code>.<\/li>\n<\/ul>\n\n1.2.0<\/h4>\n\n
\n
admin.php?page=pay4all-twint-woo<\/code>, keeping advanced WooCommerce settings in a single place.<\/li>\nhttps:\/\/pay4all.ch\/p\/twint-woocommerce#tutorials<\/code> in FR\/DE\/IT\/EN.<\/li>\npaid_status_for_p4all_form_order()<\/code> helper so Pay4All Shop and WooCommerce share the same virtual\/deferred\/default logic.<\/li>\n<\/ul>\n\n1.1.0<\/h4>\n\n
\n
.xml<\/code> schema files under src\/Engine\/Soap\/schemas\/v8_4\/<\/code>) has been removed from the plugin package per WordPress.org's blanket file-type policy. Every SOAP request is now built as a hand-written XML envelope inside TwintSoapClient::dispatch()<\/code>, transported by \\SoapClient<\/code> in non-WSDL mode (mTLS + gzip + timeouts unchanged), and the response is parsed by an in-house DOMDocument<\/code> \u2192 stdClass<\/code> converter that mimics SoapClient's classic ->_<\/code> shape so every existing consumer ($response->Order->Status->Status->_<\/code>, etc.) keeps working. Validated live against production TWINT on a small-amount payment + refund round-trip (StartOrder \u2192 GetOrder polling \u2192 ConfirmOrder \u2192 REVERSAL).<\/li>\n$args<\/code> request payload and $response<\/code> object for every operation. On WordPress.org's review request the plugin now only logs the operation name + message id, never the payload. Applies to TwintSoapClient<\/code>, TransactionService<\/code>, BackofficeTransactionService<\/code> and AdminAjax::check_successful_order_statuses<\/code>. Debug-only print_r( $this->client )<\/code> block removed.<\/li>\nset_headers()<\/code>, send_soap_request()<\/code>, get_default_params()<\/code> retired ; replaced by dispatch()<\/code> + build_envelope()<\/code> + merchant_information_xml()<\/code> helpers.<\/li>\n<\/ul>\n\n1.0.0<\/h4>\n\n
\n