BDM Digital Payment Gateway

This plugin allows you to accept payments with the BDM digital currency in your WooCommerce store. It generates QR codes for payments, performs automatic validations, and provides instant confirmations to the customer.

Main features:
* Automatic QR Code generation
* Real-time payment validation
* Compatible with BDM digital wallets
* Direct integration with WooCommerce
* Custom checkout page

External services

This plugin relies on the BDM Digital partner API (operated by Dourado Cash) to quote the BDM price, issue the payment code (QR Code) and confirm payments. All calls are made from your server and authenticated with the API key you configure; the API key is never sent to the visitor’s browser.

• Production: https://partner.douradocash.com.br/
• Sandbox (only when Sandbox Mode is enabled): https://dev-partner.dourado.cash/

What is sent and when:

• When the BDM checkout page loads and when an order is placed: the asset code (e.g. BDM), to fetch the current quotation.
• When an order is placed: your partner e-mail, the order amount in BDM and the order number (as the payment description).
• While the customer waits for the payment: your partner e-mail and the payment code of that order, to check whether it was paid.

No customer personal data (name, address, e-mail, phone) is sent to the API.

Source JS/CSS

jquery.toast.min.js: https://github.com/kamranahmedse/jquery-toast-plugin
bootstrap.min.css: https://getbootstrap.com/

License

This plugin is free software and is licensed under GPLv2 or later.

1. Upload the plugin files to the /wp-content/plugins/ directory or install directly through the WordPress dashboard.
2. Activate the plugin via the “Plugins” menu in WordPress.
3. Make sure WooCommerce is installed and activated.
4. The plugin will automatically create a checkout page (BDM Checkout).
5. Configure your integration details under Settings > BDM Gateway.

1. 

   Payment screen with QR Code

2. 

   Custom checkout page

3. 

   Settings in the admin panel

4. 
5. 

1.3.13

• Security: payment confirmation is now verified on the server. The public REST route bdm_digital_payment_gateway/v1/update-payment, which allowed unauthenticated requests with empty credentials to mark any order as paid (or failed), was removed. An order is only marked as paid after the server confirms the payment with the BDM Digital API, using the payment code stored on that order, and the paid amount must match the order total. Thanks to the security researchers Enrico Marcolini, Claudio Marchesini and Dottor Marc for the responsible disclosure.
• Security: the partner API key and the REST key/secret are no longer exposed in the checkout page. Quotation, payment code creation and payment status checks now run on the server.
• Security: the order amount is calculated on the server from the WooCommerce cart and the server-side quotation, instead of being sent by the browser.
• Security: removed the AJAX action that allowed overwriting the payment code of any order. Payment status checks require the order key.
• Removed the unused “REST API Key” and “REST API Secret” settings and the unused main.min.js file.
• Paid orders now follow the standard WooCommerce flow (payment_complete): physical products go to Processing, virtual/downloadable ones to Completed.
• Tested up to WordPress 7.1.

1.3.12

• Added a new Debug Mode checkbox in gateway settings to control BDM frontend logs during troubleshooting.
• Suppressed plugin console.log, console.warn and console.error messages when Debug Mode is disabled, without changing checkout business rules.
• Localized debug_mode to both standard and custom checkout contexts and switched main.js enqueue version to dynamic filemtime cache-busting.

1.3.11

• Add support for resumable payment links on /bdm-checkout/ via a hashed billing code (bdm_code), without creating a new order.
• Persist billing code hash, QR code image (base64) and creation timestamp on the order to enable resume and status polling.
• Automatically start QR generation when redirected from the standard checkout (bdm_autostart=1) and update the URL to the resumable link once available.

1.3.10

• Persist the generated billing code on the WooCommerce order after the external API responds.
• Display the billing code on the WooCommerce admin order screen for BDM orders.

1.3.9

• Removed custom updater routines not allowed in WordPress.org hosted plugins.
• Added nonce validation for shipping method propagation in standard checkout redirect.
• Updated plugin metadata and readme compatibility headers for current WordPress version.
• Improved plugin review compliance with additional input validation and coding standards cleanup.

1.3.5

• Include shipping totals in the BDM checkout amount and display the shipping line.
• Preserve the selected shipping method when redirecting to the BDM checkout.
• Avoid deprecated warnings by sanitizing empty description/WYSIWYG fields.

1.3.4

• Restored BDM as a selectable payment method on the standard checkout and redirect users to the custom page only when it’s chosen.

• Improved the custom checkout loading experience with quotation fallback and immediate loading indicator.

1.3.3

• Standardized plugin changelog and metadata to Portuguese.

• Preparation for release 1.3.3.

1.3.2

• Adjusted the WYSIWYG field in the settings to enable the save button as soon as there are changes.

• Added a specific script in the admin to detect changes in the editor and notify WooCommerce.

1.3.1

• Added a WYSIWYG field in the settings to customize the checkout notification.

• The custom checkout template now displays the configured text.

1.3.0

• Added automatic update system from GitHub releases
• Fixed REST API permission issues for payment updates
• Improved WordPress coding standards compliance
• Enhanced security for API endpoints

1.2.7

• Fixed database AUTO_INCREMENT issues
• Improved order creation process
• Enhanced error handling