Invum POS Entegratör – Sanal POS ve Taksitli Ödeme

Changelog

1.0.32

• Fix: WooCommerce Subscriptions — the card a subscription is bought with (a saved card, or the card saved during that payment) is now attached to the subscription. Before, the first automatic renewal could not find a saved card unless the customer changed the payment method by hand.
• Fix: PayTR Direct — a card saved during payment is now stored on stores that use only a PayTR Direct account; for subscription orders the card is saved even if the “save card” box is not ticked.
• Fix: Subscription renewals (WooCommerce Subscriptions and the membership, donation and course bridges) no longer fail with “No adapter resolved” when the provider is not the store’s default account; a renewal is charged on the subscription’s own payment method and POS account.
• Fix: PayTR Direct subscription renewals were sent to the PayTR iFrame integration, which cannot charge a saved card, and always failed; they are now charged through PayTR Direct.

1.0.31

• Security: Card-testing protection, the installment lookup limit and the payment provider call budget now count requests sent at the same time correctly; parallel requests could previously slip past the limits.
• Security: Card-testing protection counts a logged-in customer’s attempts on their account instead of the billing email, so someone typing that customer’s email at checkout can no longer block them.
• Fix: With several accounts for the same provider, the background job now checks an open 3D Secure payment on the account the order was charged with (PayTR, iyzico, VakıfBank, Craftgate, NestPay banks).
• Fix: Pending orders of other payment methods no longer push this plugin’s orders out of the background job’s batch.

1.0.30

• Improvement (paid plans): Garanti BBVA and Moka payments whose customer closed the 3D Secure page are now checked with the bank by the background job; an order the bank has charged is marked paid and can be refunded from the plugin.
• Fix: Orders placed through the main “Invum POS” payment method were never checked by the background job for payments left open on the 3D Secure page.
• Fix: The background job and a late bank callback could settle the same order at the same time; they now take turns, and the job re-reads the order before changing it.
• Fix: An order whose earlier payment attempt was already closed by the bank callback is no longer re-checked using that attempt, and orders paid through the main payment method are never cancelled by the background job.
• Improvement: A PayTR payment confirmed by the background job is now refundable from the plugin, and is accepted only when nothing was refunded and the amount matches the order.

1.0.29

• Change (paid plans): Every bank and provider (Garanti BBVA, Yapı Kredi Posnet, VakıfBank, Craftgate and Moka, alongside the 12 NestPay banks) now opens on the Pro plan. Studio and Agency keep their advanced rules, bridges, extra sites and white label.
• Improvement: The bank list on the Dashboard upgrade card is worded as a question and notes that it does not change your plugin settings.

1.0.28

• Improvement: On sites without a license, the Dashboard upgrade card now asks for your bank and shows the plan that supports it, its yearly price (VAT included) and a direct link to the order page, together with the refund terms.
• Improvement: 34 Turkish interface strings that still contained English words (endpoint, credential, gateway) were translated.
• Fix: The “Learn about Invum POS Pro” link on the new POS account screen pointed to a page that no longer exists; it now opens the plan comparison.

1.0.27

• New: A “▶ Watch the video guide for this screen” link in the header of the screens (Dashboard, POS Accounts, Transaction Logs, Payment Links, Installment Compliance, Installment Display, Smart Rules and Simulator). Hidden on white-label sites.
• Improvement: The plugin’s Documentation page lists the current guides and error pages (VakıfBank, PCI merchant guide, new error code pages); the retired Param was removed from the list.

1.0.26

• Fix: In the Payment Links list the status was shown raw as “pending”, “paid”; it now reads Pending, Paid, Expired, Cancelled.
• Fix: Under the product lines on the order screen the plugin’s internal records (BDDK product group, store installment limit) were shown with raw key names; they are now hidden. The records were not deleted and remain as an audit trail.

1.0.25

• Critical fix (full version only, Moka): When Moka became “Moka United” its server addresses changed; the plugin was calling the old addresses. The order field in the 3D return was also read with the wrong name and successful payments could be marked “failed”. Payment, failed payment and refund were verified end to end with a real test account in the Moka United test environment.
• Fix (full version only, Moka): “Test Connection” calls the right endpoint; a wrong password and a missing server IP permission are reported with separate messages.
• Fix (full version only, Garanti BBVA): Every payment attempt goes to the bank with its own order number. When a customer whose card was declined tried to pay the same order again, Garanti rejected it with “Only one sale is allowed within the same order”. Refunds and voids use this number; older orders are not affected.

1.0.24

• Security: Adding, editing and deleting POS accounts and testing their connection are now open only to site administrators by default. Shop Manager accounts can see them but cannot enter keys; transaction logs, payment links and reports stay available to Shop Managers. If you deliberately want the old behavior: add_filter( 'invum_pos_manage_accounts_capability', fn() => 'manage_woocommerce' );
• Fix (full version only): “Multi-account routing” was wrongly shown as locked to the Agency plan on the Features page; the feature already worked on Pro and higher plans.
• New: If the plugin has been useful, a WordPress.org review is requested once on the plugin’s own pages after at least 10 successful payments and 14 days; it can be dismissed with “Later” or “Don’t ask again”. Never shown on white-label sites.
• Improvement: The plugin’s display name is now “Invum POS Entegratör – Sanal POS ve Taksitli Ödeme”.
• Fix: Direct-access protection in one plugin file was moved to where the WordPress.org check looks for it.

1.0.23

• Fix: PayTR saved-card payments and WooCommerce Subscriptions renewal charges were sent with an order number format PayTR does not accept (with underscores); the charges were rejected before reaching the bank. The order number now contains only letters and digits as PayTR requires.
• Security: Saved-card tokens returned in payment provider responses (iyzico cardToken / cardUserKey, PayTR utoken and similar) are now written to transaction logs masked; existing records are masked once on update. Masking also catches card numbers with spaces/dashes and card fields in XML / form bodies; log messages are masked too.
• Security: Two payment notifications arriving at the same time for the same order are now reliably merged into a single transaction (the database lock is truly atomic).
• Security: In the CSV export of transaction logs, values starting with “=”, “+”, “-“, “@” are not executed as Excel formulas.
• Security: Live calls from the installment and BIN lookup endpoints to the payment provider are bound to a site-wide per-minute budget; empty responses are also cached briefly. When the budget is used up the customer only sees a single payment, checkout does not break (invum_pos_upstream_budget_per_minute filter).
• Fix: A payment link counts as “paid” only if the order carries a line for the link’s amount and is not cash on delivery.
• Fix: When changing a subscription’s payment method, the selected saved card is verified to belong to the subscriber.
• Fix: Leading/trailing spaces in API keys are trimmed on the POS account form (signature errors caused by copy-paste).
• Security fix (full version only): The VakıfBank 3D Secure return was processed even without the verification ID sent by the bank; the ID is now required and must match the order’s record.
• Fix (full version only): The “translation loaded too early” notice logged on every request on WordPress 6.7 and later was resolved.