Harden Security Update

[Abraham-Flutterwave]

Payment security

• Return route requires a signature: handleReturn is removed from the public routes and uses GiveWP's signed URL.
• Completion needs a full match: the Flutterwave tx_ref must equal a reference saved for that donation, and the amount and currency must match. A small payment can no longer complete a bigger donation.
• Webhook is wired up and verified: it now uses the webhookNotificationsListener() method GiveWP calls (it was never reached before). It needs a secret hash of 16+ characters in the verif-hash header, and every result is re-checked with the Flutterwave API.
• Test and live keys are separate: GiveWP test mode picks the key, and a key with the wrong prefix is refused.
• Status changes are limited:
  • Refunded or completed donations are never overwritten.
  • Only pending donations can be marked failed or cancelled.
  • Callers can't fail donations: a request with a bad or made-up reference can no longer mark someone else's donation failed.
• No double completion: a per-donation lock stops the webhook and the donor's return from both completing a donation.
• Checkout links: the redirect must be an HTTPS link on flutterwave.com.

Bugs fixed along the way

• Zero-decimal currencies: UGX, RWF, XAF and XOF donations were charged 1% of the amount; amounts now come from formatToDecimal().
• Checkout payload: it sent reference instead of v3's tx_ref.
• Webhook URL: getWebhookUrl() called a method that doesn't exist.
• Older GiveWP: the plugin crashed on versions below 4.5; it now shows a notice instead.

Data and logs

• Donor errors: donors see a generic message, and details go to the log.
• Logs: they no longer store customer details.
• Admin screen: keys use masked api_key fields, and the settings page shows the webhook URL.
• Admin notices: they warn about wrong keys, a short webhook secret, or a webhook URL that isn't HTTPS.
• Old settings: the single secret key is moved to the new Live or Test field, then the old options are deleted.
• Uninstall: uninstall.php deletes all keys and locks.

Packaging and cleanup

• Distribution: .distignore and index.php files were added. Test files only run from the command line.
• Removed: the dead flutterwave-inline.js and getTransactionUrl().
• Function names: they now have a give_flutterwave_ prefix. The currency list lives in one constant.
• PHP version: composer.json now says PHP 7.4+, matching the plugin header.
• Docs: the README and readme text cover install-from-zip, the new key and webhook setup, and the GiveWP 4.5.0 minimum.

Tests

They went from 6 to 41. New files are ReturnRouteTest.php and TestState.php, and GatewayTest.php and WebhookTest.php were expanded.