=== Coriunder Payment Gateway ===
Contributors: Josh Daniel
Company link: http://www.Coriunder.com
Tags: direct, redirect, form, woocommerce, woothemes, devicesoftware
Requires at least: 6.9
Tested up to: 7.1
Requires PHP: 7.4
WC requires at least: 10.9
WC tested up to: 11.0.1
Stable tag: 1.3.1

WooCommerce Coriunder Hosted Payment Gateway

== Description ==

Coriunder hosted payment gateway for WooCommerce. Customers are redirected to the Coriunder hosted payment page and returned to WooCommerce after payment. Configure the gateway under WooCommerce > Settings > Payments.

The plugin supports classic checkout, Cart and Checkout Blocks, and High-Performance Order Storage (HPOS). HTTPS is required for production use.

== Installation ==
Installation :

1. Download.

2. Upload to your /wp-contents/plugins/ directory.

3. Activate the plugin through the 'Plugins' menu in WordPress.

4. Goto Woocommerce -> Settings and select the Payment Gateways tab and click on Coriunder just below the tabs.

Configure Gateway:

1. Add your 'Merchant Number ' which would have been supplied by Coriunder.

2. configure other processing options on this page

== Frequently Asked Questions ==
= Does it support 3D Secure =
Yes it does, to enable it you first need to contact Coriunder and then set Process method to "Use PaymentPage Redirection".

== Screenshots ==
1. Coriunder settings screen
2. Customer payment page

== Changelog ==
= Version 1.3.1 - 25082026 =
* Security - Payment callbacks are verified against Coriunder transaction status before an order can be marked paid or failed
* Security - Callback verification now checks merchant, order, transaction, amount, currency and transaction type where available
* Security - Debug logs no longer write full payment URLs, customer PII or callback signatures
* Security - Base URL is restricted to a valid HTTPS URL
* Compatibility - HPOS order metadata now uses the WooCommerce order CRUD API
* Compatibility - Blocks checkout availability now respects the configured store currency
* Compatibility - Updated compatibility metadata for WordPress 7.1 / 7.0.4 and WooCommerce 11.0.1 / 10.9.4
* Fix - Authorization-only payments are kept on hold instead of being treated as captured payments
* Fix - Added direct-access guard and removed generic callback function names
= Version 1.3.0 - 24082026 =
* Feature - Gateway Logo: the logo shown on the settings screen and at checkout is now uploaded by the merchant through the WordPress media library. A "Select image" / "Remove" picker was added to the General section
* Change - No logo is bundled with the plugin any more. When no logo has been uploaded, the settings header and the checkout payment method render without an image instead of falling back to the built-in Coriunder logo
* Change - Removed the "Test & Debug" sandbox settings: Enable Test Mode, Test Merchant ID, Test Personal Hash and Test Base URL are gone. The gateway always uses the Live Credentials
* Change - Removed the "Test mode is active" admin notice and the "Test Mode Active" badge from both the classic and Blocks checkout
* Change - Debug Logging kept, moved into its own "Debug" section
* Change - Blocks checkout availability and webhook signature verification now read the live Personal Hash directly; the sandbox branch was removed
* Note - Merchants upgrading from 1.2.x who were running in test mode must fill in the Live Credentials; previously saved test credentials are no longer used

= Version 1.2.1 - 16042026 =
* Fix - Plugin header updated: WC tested up to 10.7.0, Requires WordPress 6.8+, Requires PHP 7.4+
* Fix - validate_fields(): billing_phone is now sanitized with sanitize_text_field() before use
* Fix - validate_fields(): error notice strings wrapped in esc_html__() for translatability
* Fix - process_payment(): replaced $woocommerce->cart->empty_cart() with WC()->cart->empty_cart()
* Fix - Orders no longer stuck in pending after payment: reply code and order status are now resolved on the thank-you page via the woocommerce_thankyou_coriunder hook, which reads Coriunder's redirect params (replyCode, trans_id, trans_refNum) and calls payment_complete() immediately when the customer returns
* Fix - Signature verification corrected for both the redirect and webhook: Coriunder sends raw base64 (not URL-encoded), and the redirect uses SHA256(reply_code . trans_id . personal_hash)
= Version 1.2.0 - 09042026 =
* Improvement - Blocks checkout: logo in label row enlarged (28px height) for better visibility
* Improvement - Blocks checkout: payment method title is now bold
* Improvement - Blocks checkout: removed duplicate logo from the description row
* Improvement - Blocks checkout: reduced spacing between title and description
= Version 1.1.9 - 09042026 =
* Improvement - Classic checkout: logo shown inside the payment box with styled description area
* Improvement - Classic checkout: light blue hover (#eef3fb) on the payment method label row
* Improvement - Classic checkout: focus-visible ring on keyboard navigation to the radio button
* Improvement - Blocks checkout: logo displayed inline beside the payment method title in the label
* Improvement - Blocks checkout: styled content area (logo + description + test badge) when selected
* Improvement - Blocks checkout: hover highlight on the option row via :has() selector
* Improvement - Test mode badge shown in checkout description for both classic and blocks checkout
* Improvement - Frontend CSS enqueued via wp_enqueue_scripts only on checkout pages (no impact elsewhere)
= Version 1.1.8 - 09042026 =
* Improvement - Replaced settings page with responsive card-based UI (grouped into General, Live Credentials, Test & Debug sections)
* Improvement - Replaced native checkboxes with accessible toggle switches (WCAG 2.1 AA compliant focus management)
* Improvement - All form controls now have explicit labels, aria-describedby help text, and visible focus rings
* Improvement - Settings sections use semantic HTML (section + aria-labelledby, role attributes)
* Improvement - Hash fields use type="password" and autocomplete="new-password" to prevent credential exposure
* Improvement - Test-mode banner shown inline on settings page when sandbox is active
* Improvement - Two-column responsive grid collapses to single column on mobile (≤782px)
= Version 1.1.7 - 09042026 =
* Security - Added webhook signature verification to prevent forged payment confirmations
* Security - Added input sanitization for all webhook parameters (trans_order, trans_id, reply_code, reply_desc)
* Security - Fixed stored XSS vulnerability in admin order view (utm_source output now escaped)
* Security - Fixed esc_html__() misuse with dynamic strings in order notes
* Security - Debug logging in webhook handler is now gated on the debug setting
* Security - Removed deprecated webhook() method that used unsanitized $_REQUEST data
* Improvement - Added "Settings" action link on the Plugins page
= Version 0.9.0.0 - 25042014 =
* Feature - Initial release
= Version 0.9.0.5 - 04022016 =
* Feature - small updates
