In WordPress "wp_redirect" function need to be used with the "exit" function. If is not it redirect page but the code after is excuted.
In "check_dotpay_response_legacy" function after checking the Dotpay ID. If its wrong it gets redirection but also for example continue to changing order statuses.
At my page which was using CloudFlare. Dotpay response comes with the cloudeflare IP instead of the Dotpay ID. All orders information which come from the Dotpay to the system change WooCommerce order statuses but also wasn't satisfied by the "OK" answer. So it continues to send the same information again and again. It also get some other isusses for example if firstly payment was refused but another payment was accepted. In this situation. Orders get statuses Completed and Refused alternately.
This was only my case but this problem could be bigger if someone will start to send POSTs from other IP but will could change Order statuses
In WordPress "wp_redirect" function need to be used with the "exit" function. If is not it redirect page but the code after is excuted. In "check_dotpay_response_legacy" function after checking the Dotpay ID. If its wrong it gets redirection but also for example continue to changing order statuses.
At my page which was using CloudFlare. Dotpay response comes with the cloudeflare IP instead of the Dotpay ID. All orders information which come from the Dotpay to the system change WooCommerce order statuses but also wasn't satisfied by the "OK" answer. So it continues to send the same information again and again. It also get some other isusses for example if firstly payment was refused but another payment was accepted. In this situation. Orders get statuses Completed and Refused alternately.
This was only my case but this problem could be bigger if someone will start to send POSTs from other IP but will could change Order statuses
Regards, Michał Strześniewski