[5.1.2] "Change Payment" button redirect to WP Admin instead of My Account when updating payment method.

[francoishvz]

Describe the bug

Since 5.1.0 of WooCommerce Subscriptions, when changing the payment method, users are redirected to the WP Admin area instead of to the My Account area.

This is specifically for the following payment gateways:

• Pensopay Payments
• Quickpay Payments
• Reepay Payments

To reproduce

1. Ensure you are using one of the payment gateways mentioned above.
2. After purchasing a subscription head to My Account -> Subscriptions, and select the 'Change Payment' button.
3. You are redirected to the /checkout page which is correct.
4. However after following the prompts, instead of being redirected back to the 'My Account' page, you are redirected to WP Admin instead.

Screencast

https://www.loom.com/share/fc2ccee1ad68437c8448ae639247a8ef

Expected behavior

Users should be redirected to the "My Account" page and see the following confirmation message:

Additional details

5.0.1 and below works correctly (tested down to 4.8)

6333127-zen

[tolvstein]

This seems to be caused by the use of wp_safe_redirect used on the external payment window link, which the user is supposed to be redirected to after clicking the "Change payment method" submit button.

It seems to have been introduced in WCS 5.1.0 in: WC_Subscriptions_Change_Payment_Gateway::change_payment_method_via_pay_shortcode

[PThagaard]

Is there any way to temp-fix this issue? If it goes to all external-paged gateways; i'd assume the issue goes to almost all users of WCS.

(This is our ticket; but havent heard back regarding a fix - so assume its still shelved)

[tolvstein]

We have fixed it by adding the external hos / gateway provider to the safe domain list allowing to use wp_safe_redirect to redirect to the payment window. This is now built in to the QuickPay integration for WooCommerce btw.

[PThagaard]

Thanks; so for future reference (new gateways); we need to add the payment-domain to the allowed_redirect_hosts.

Tested and works (with Pensopay plugin - since they use quickpay as window) for 5.1.0+

add_filter( 'allowed_redirect_hosts', 'thagaard_pensopay_safedir_fix' );
function thagaard_pensopay_safedir_fix( $hosts ){
    $hosts[] = 'payment.quickpay.net';
    return $hosts;
}