Friday, July 10, 2026
1 change · saas-19.4
Resolved issues and error corrections
This update strengthens the security of our payment processing by ensuring only the transaction reference is used, rather than all payment data. This prevents potential vulnerabilities and ensures the system only processes data it needs to find and trigger payment processing, improving overall system stability.
Original PR description
The `/payment/custom/process` was blindly processing any payment data it was receiving while its only purpose is to find the transaction from the posted arguments and trigger its processing. This commit clarifies that only the transaction reference is expected as an argument and reconstructs the payment data payload from it.