[Flowless.AI] Code improvements

[mozinova]

🔍 Flowless.AI Analysis

This PR was automatically generated by Flowless.AI based on code analysis.

Modified Files (3)

• README.md: Surgical patches to README.md to address critical security vulnerabilities: (1) Add PHP/WHMCS version requirements and SSL enforcement, (2) Change Webhook Secret from Optional to Required in both Installation and Configuration sections, (3) Fix Security section to indicate signature verification is enabled by default rather than commented out, (4) Add HTTPS requirement warning for webhook URLs. These changes align documentation with secure configuration states and remove normalization of insecure defaults.
• modules/gateways/callback/paysgator.php: Surgical patches to address critical security vulnerabilities: (1) Enable webhook signature verification to prevent unauthorized payment injection, (2) Improve invoice ID extraction with robust regex pattern to prevent parsing errors, (3) Add amount and currency validation against invoice totals to prevent financial manipulation attacks
• modules/gateways/paysgator.php: Applied critical security fixes (SSL verification), improved transaction ID uniqueness to prevent collisions, and added missing refund function for complete gateway implementation

Summary

README.md:

• ⚠️ Security: Webhook signature verification code is commented out by default (line 58), potentially leaving webhooks vulnerable to unauthorized requests
• ⚠️ Installation ambiguity: Path structure description could confuse users about exact folder placement in WHMCS root
• ⚠️ Missing version compatibility: No PHP or WHMCS version requirements specified

modules/gateways/callback/paysgator.php:

• ⚠️ Critical security vulnerability: Webhook signature verification is commented out (lines 34-41), allowing potential unauthorized webhook injection
• ⚠️ No amount validation against invoice total - could allow payment manipulation
• ⚠️ No currency validation against invoice currency
• ⚠️ Fragile invoice ID parsing from externalTransactionId using string split on 'inv' delimiter
• ⚠️ No rate limiting or replay attack protection beyond transaction ID check

modules/gateways/paysgator.php:

• ⚠️ Missing SSL certificate verification (CURLOPT_SSL_VERIFYPEER not set) - vulnerable to man-in-the-middle attacks
• ⚠️ No webhook handler function defined despite webhookSecret configuration - cannot receive payment status updates
• ⚠️ No refund capability implemented (missing paysgator_refund function)
• ⚠️ External transaction ID could have collisions if multiple invoices created in same second
• ⚠️ No logging of API requests/responses for debugging and audit purposes

---

Generated by Flowless.AI • Task ID: eabf2912-16ed-4d4a-91c1-ca324b0f1a28