fmido88 / moodle-paygw_paymob Goto Github PK

in your styles.css you define a number of generic styles that could clash with core moodle code or other locations where simliar names are used.

Moodle helpfully adds a number of classes to the body tag based on the path that you can use such as:
eg if you are have a file in mod/assign you would see the following class added to the body tag
path-mod-assign
so if you have an item with the class "filething" on the page you would target it like:

.path-mod-assign .filething {
   color: red;
}

Take a look at some of the css in other payment gateway plugins for good examples on how to target the payment window when your gateway is selected.

Please make sure your css classes in styles.css are specific enough so they cannot clash with other core code - note this is a blocker for plugins db approval.

your plugin seems to send email/firstname/lastname/country/phone number/city to the external payment gateway - this needs to be documented in the external_location_link part of the privacy api.

more info on this is here:
https://moodledev.io/docs/apis/subsystems/privacy#indicating-that-you-export-data-to-an-external-location

You have some incorrect use of PARAM_RAW in callback.php and you also have areas in that file that gets the raw data from $_GET and $_POST type calls but do not santise the values before you use them.

please use clean_param() or other apis to make sure the data is in an expected form before you use it.

Note: this is part of our security checklist and therefore is a blocker for plugins db approval

https://github.com/fmido88/moodle-paygw_paymob/blob/main/classes/paymob_helper.php#L76

Please don't initate curl_init() directly but use Moodle's own "curl" class which is a wrapper on PHP's curl functions and takes care of various security and proxy settings within Moodle - it's not documented well, but do a search on core code for "curl" to see it's usage.

https://github.com/fmido88/moodle-paygw_paymob/blob/main/lang/en/paygw_paymob.php#L54

on approval in the plugins db - all strings are passed to our translation tool "AMOS" to allow users to translate them. Best to remove this string from the lang file as it will get very confusing for people using AMOS.

You can include an Arabic lang pack in your plugin if you want to, although it is typically easier to get AMOS to manage the strings and do the translation via the AMOS site when your plugin has been accepted.

Note this is a blocker for plugins db approval.

Various places in process.php (possibly other files too) have hard-coded english lang strings eg:
https://github.com/fmido88/moodle-paygw_paymob/blob/main/process.php#L162-L163

Note - this is a blocker for plugins db approval - all user facing strings must sit within the lang file.