Shashura Mobile Money for CampTix
| 开发者 |
cipherwave
ssebuwufumoses |
|---|---|
| 更新时间 | 2026年10月31日 01:50 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Shashura Mobile Money for CampTix adds MTN and Airtel Mobile Money as a payment option for CampTix, the WordPress event ticketing plugin used by WordCamp and community events. It is built for organisers selling tickets in Uganda who need a payment method their attendees already use day to day. This plugin is developed and maintained by Techdom Digital Solutions and is not affiliated with, or endorsed by, the CampTix project.
A Shashura merchant account is required to use this plugin. Sign up or log in at https://shashura.com.
The plugin connects CampTix to the Shashura Mobile Money API and handles the full collection lifecycle: number verification, the PIN push to the buyer's phone, settlement confirmation, and reconciliation. It runs against either Shashura's Sandbox or Production environment, and endpoint overrides are controlled by trusted deployment code, never per-site settings. See ENDPOINT-POLICY.md for migration and development testing.
How a payment works
- The buyer selects Mobile Money at checkout and enters their MTN or Airtel number.
- The number is verified against the network before anything is charged, and the registered account name is shown to the buyer for confirmation.
- A PIN prompt is pushed to the buyer's phone for the exact order total.
- The plugin confirms the payment with Shashura directly rather than trusting the browser or an incoming webhook on their own. Both only trigger a check; only a status enquiry whose reference and amount match the order can mark it paid.
- Once confirmed, the buyer is taken to their CampTix ticket page and receives CampTix's standard confirmation email.
- Every payment prompt on an order is tracked and reconciled, including ones approved after a buyer tried more than once.
- A duplicate payment on the same order is detected and flagged to the site administrator for a manual refund, rather than accepted or dropped silently.
- Incoming webhooks are verified against an HMAC-SHA256 signature. Unsigned, forged, oversized or mismatched-environment events are rejected.
- A per-order lock stops the webhook, the buyer's browser, an order cancellation and CampTix's own timeout sweep from recording conflicting outcomes for the same order at the same time.
- A payment approved after an order was cancelled or timed out is still recognised and completes the order.
- Works with both current CampTix (2.x) and CampTix 1.4.x, using the reconciliation strategy appropriate to each.
- CampTix, with the ticket currency set to UGX.
- A Shashura merchant account with an app configured for Mobile Money collections, and its Client ID, Client Secret and Webhook Secret.
- A publicly reachable site, with the server's outbound IP whitelisted on the Shashura app, so callbacks and settlement can reach the plugin.
安装:
- Install and activate CampTix. Under Tickets → Setup → General, set the ticket currency to UGX.
- Upload the plugin zip file under Plugins → Add New → Upload Plugin, then activate it.
- Go to Tickets → Setup → Payment and open the Mobile Money (MTN / Airtel) section:
- Set Enabled to Yes.
- Enter the Client ID and Client Secret from your Shashura app (see "Getting Your Shashura API Credentials" below).
- Choose Sandbox while testing. Switch to Production only when ready to take real payments.
- Enter the Webhook Secret shown on your Shashura app. Mobile Money is not offered at checkout until this is set.
- API endpoints are controlled by trusted deployment code; see ENDPOINT-POLICY.md.
- Copy the webhook URL shown under Webhook Secret and set it as the Callback URL on the matching app in your Shashura dashboard.
- Ask Shashura to whitelist your server's outbound IP address for that app. Requests from an IP that is not whitelisted are rejected.
- Save your settings. The Connection line confirms whether the credentials authenticate successfully.
屏幕截图:
常见问题:
Which currencies are supported?
Uganda Shillings (UGX) only, matching Shashura's Mobile Money coverage.
Does this plugin process refunds?
Yes. Use CampTix's own "Refund" button on the attendee screen — full, partial, and refund-all are all supported. Only the amount the organizer actually received is reversed; Shashura's processing fee is not refunded. The attendee gets the refunded amount back on the same phone number that paid.
What happens if a buyer closes the browser tab after approving the PIN prompt?
The payment still settles. Shashura's webhook, and CampTix's own timeout check on CampTix 2.x, both ask Shashura directly whether the order was paid, independently of whether the buyer's browser is still open.
Can I switch between Sandbox and Production while orders are still open?
Avoid it. A prompt sent under one environment cannot be checked while the plugin is configured for the other. It stays in a waiting state, never shown as failed, until the environment is switched back.
Where do I see what happened on a specific order?
Open the attendee's edit screen under Tickets → Attendees. The CampTix log on that screen records every check, error, amount mismatch or duplicate-payment warning for that order.
Can this connect to a Shashura deployment other than the public default?
Yes. A trusted deployment operator can set SHASMOMO_BASE_URL or use shasmomo_base_url. Per-site URL settings are ignored. See ENDPOINT-POLICY.md.
更新日志:
1.0.4
- Hardened the API endpoint: removed the per-site "API Base URL" setting entirely (including silently clearing any previously saved value). The endpoint is now fixed to Shashura's public API unless explicitly overridden by trusted deployment code (a
SHASMOMO_BASE_URLconstant inwp-config.php), never by a site's saved settings — closing a path where a compromised or tampered settings save could have redirected API credentials to another server. All requests now go through WordPress's safe HTTP transport, which blocks requests to private/internal network addresses. - The buyer now sees a specific reason when a payment is declined (not enough balance, wrong PIN, cancelled, timed out, etc.) instead of a generic "declined or expired" message.
- A payment collected for the wrong amount is no longer treated as a failed payment. It's held for reconciliation instead: the buyer is told not to pay again, the order is never auto-cancelled, and the site administrator is emailed once with the details needed to resolve it.
- Refunds are now confirmed, not assumed. CampTix is only told a refund succeeded once Shashura confirms the customer's phone actually received the money — a reversed ledger entry with an unconfirmed or failed payout now holds the order for manual reconciliation instead of silently reporting success. Concurrent or repeated refund clicks on the same order are blocked while one is in progress.
- A refund payout that resolves after the fact (the common case for MTN, which confirms asynchronously) now automatically clears that reconciliation hold once Shashura confirms delivery, instead of requiring a manual check.
- The buyer-facing payment pages now show the actual MTN MoMo and Airtel Money logos instead of a coloured badge with the network name. A site without permission to use the official logos can restore the plain badge, or supply its own image, through the
shasmomo_network_logofilter. - Updated plugin credits: now developed and maintained by Techdom Digital Solutions. Added Cipherwave Software Limited and Moses Ssebuwufu as contributors.
- Added refund support: CampTix's "Refund" button (single, partial, and refund-all) now works through the Shashura API. The attendee's money is sent back to the phone that paid; Shashura's processing fee is not refunded.
- The "Powered by Shashura" credit link on buyer-facing payment pages is now off by default and only shown if the site administrator explicitly turns it on in the payment settings.
- Renamed internal functions, classes, defines and filters from the generic "ctx_shashura"/"CTX_Shashura" prefix to a more distinctive "shasmomo"/"Shasmomo" prefix, to avoid clashing with other plugins.
- Fixed the plugin header's License field to a format reliably recognised by the Plugin Check tool.
- Renamed from "CampTix Shashura Mobile Money" to "Shashura Mobile Money for CampTix" to avoid implying official affiliation with the CampTix project.
- Documented the plugin's use of the Shashura Mobile Money API under "External services".
- Initial release. MTN and Airtel Mobile Money collection for CampTix via the Shashura API, with number verification, webhook and status-enquiry reconciliation, duplicate-payment detection, and support for both CampTix 2.x and 1.4.x.