Woocommerce Redsys Gateway Version History

* SECURITY [Medium]: Fixed an authenticated account takeover vulnerability that could allow an attacker to assume any user account, including administrators.
* SECURITY [Low]: Fixed unauthenticated access to order status and user data.
* FIX: PayGold link generated from admin order metabox was never saved correctly due to an impossible response code condition in send_paygold_link(). The function now uses the same validation logic as the checkout flow (response code 9998).
* FIX: Fixed undefined $description variable in paygold_metabox_save() when sending a PayGold link from the order edit screen.
* FIX: Custom notification domain (redsys_url_notify) was broken by check_url() prepending home_url() to URLs that already had a different domain. check_url() now detects absolute URLs and preserves them as-is.
* FIX: get_notify_home_url() now automatically adds https:// when the custom notification domain is saved without a scheme.
* FIX: PHP 8.3+ compatibility — Fixed deprecated warnings for passing null/false to string functions (trim, strlen) from get_option() calls in get_txnid(), get_token_type(), and connect_standard_imap().
* FIX: PHP 8.3+ compatibility — Fixed add_submenu_page(null,...) in setup guide causing strpos()/str_replace() deprecation warnings.

* NEW: Virtual / Downloadable Products order status override in Advanced Settings. When all products in an order are virtual or downloadable, the order status can be automatically set to Completed instead of Processing.
* NEW: Redsys response code 0115 (card cancelled or account closed) now automatically deletes the stored card token, notifies the customer with instructions to add a new payment method (My account > Payment Methods), and notifies the admin.
* NEW: Admin email notification when a customer's credit card is automatically removed due to Redsys hard-decline response codes (0115, 0172, 0173).
* NEW: Improved customer email when a card is removed — now includes the last 4 digits of the card, the error code, and a direct link to add a new payment method.
* NEW: COF_INI (Credential on File initial) flag is now saved to order meta (_redsys_cof_ini) for all COF transaction types (R and C), preventing duplicate token creation when COF_INI=N.
* FIX: Conditional Rules test mode now correctly applies to the Redsys gateway URL. Previously, orders with conditional rules overriding test mode still used the default gateway URL.
* FIX: Fixed duplicate token creation when customer already has a saved card and COF_INI=N is sent to Redsys.
* FIX: Fixed undefined array key warnings in save_field_update_order_meta() when conditional rules data is incomplete.
* FIX: Fixed $redsys->debug reference using wrong variable in preauthorization logging (now uses $this->debug).
* FIX: Fixed sanitize_text_field applied before substr for HTTP_ACCEPT_LANGUAGE in Google Pay and Apple Pay Checkout, ensuring correct sanitization order.
* FIX: Google Pay Checkout now ensures WooCommerce transactional emails are initialized before calling payment_complete() in payment callbacks.

* FIX: Google Pay Express Checkout now triggers WooCommerce transactional emails after successful payment (customer and admin).