Version 2.1.0

Author: tubiz

includes/class-paystack-deprecated.php

@@ -386,14 +386,19 @@ public function verify_paystack_transaction() {
 	 */
 	public function process_webhooks() {
 
-		if ( ( strtoupper( $_SERVER['REQUEST_METHOD'] ) != 'POST' ) || ! array_key_exists( 'HTTP_X_PAYSTACK_SIGNATURE', $_SERVER ) ) {
+		if ( ( strtoupper( $_SERVER['REQUEST_METHOD'] ) != 'POST' ) || ! array_key_exists('HTTP_X_PAYSTACK_SIGNATURE', $_SERVER) ) {
 			exit;
 		}
 
-		http_response_code(200);
-
 	    $json = file_get_contents( "php://input" );
 
+		// validate event do all at once to avoid timing attack
+		if( $_SERVER['HTTP_X_PAYSTACK_SIGNATURE'] !== hash_hmac( 'sha512', $json, $this->secret_key ) ) {
+			exit;
+		}
+
+		http_response_code(200);
+
 	    $event = json_decode( $json );
 
 	    if( 'charge.success' == $event->event ) {

includes/class-paystack.php

@@ -560,10 +560,15 @@ public function process_webhooks() {
 			exit;
 		}
 
-		http_response_code(200);
-
 	    $json = file_get_contents( "php://input" );
 
+		// validate event do all at once to avoid timing attack
+		if( $_SERVER['HTTP_X_PAYSTACK_SIGNATURE'] !== hash_hmac( 'sha512', $json, $this->secret_key ) ) {
+			exit;
+		}
+
+		http_response_code(200);
+
 	    $event = json_decode( $json );
 
 	    if( 'charge.success' == $event->event ) {