Prometheus - Donation and payment store

Web

Fixed the new PayPal API gateway. We did not implement the gateway properly, and assumed it would work similar to Stripe.

Thanks to Ethorbit for figuring this out and kindly providing us with a fixed example of the payment flow code.

If you have already set up the new PayPal API gateway you need to configure a few more webhook event types. You should now have the following types:

1. Checkout -> Checkout order approved
2. Payments & Payouts -> Payment capture completed
3. Customer dispute -> Customer dispute created

Modified files

Web

1. inc/functions.php
2. paypal.php

Web

Introduced PayPal API as a long awaited replacement for PayPal IPN.

As of right now it only supports single purchases, just like Stripe. We will add subscriptions in the future, but for some reason PayPal's new server SDK does not support them yet.

Modified files

Web

1. inc/functions.php
2. composer.json
3. composer.lock
4. vendor/*
5. compiled/*
6. mix-manifest.json
7. paypal.php
8. store.php
9. inc/classes/gateways.class.php
10. inc/classes/lang.class.php
11. inc/classes/paypal.class.php
12. inc/admin_sidebar.php
13. admin/gen/nav.php
14. admin/gen/paypal-ipn.php
15. admin/gen/paypal.php

Important for NGINX users: Please delete your ipn_errors.log, stripe_errors.log and paymentwall.txt files or apply the following directive in your nginx config:

Web

1. Deleted any log files from the root directory, and stopped writing to them. Read the regular php error log instead.

Modified files

Web

1. inc/functions.php
2. .htaccess

Web

1. Fixed miscellaneous PHP error notices and deprecations.
2. Several code improvements across the board.
3. Editing a theme now works again.
4. Theme editor icon now displays correctly.
5. Editing or creating a theme no longer changes the active theme to the theme you are currently editing.
6. Fixed dashboard graph labels (they no longer say "undefined").
7. Made sure files in the install folder cannot be reached directly, this also applies to a lot of other files that are normally protected by htaccess (when using apache) or the nginx config too.
8. The "updates" area no longer throws an internal server error.

Important notice: If you have any custom standalone pages they must now set the ABSPATH constant before including functions.php or any other file that should be access protected.

Modified files

Web

1. Pretty much all files have been touched because of the ABSPATH change

Web

1. Fixed a few notices and strange behaviour that could happen directly after installation on some systems

Modified files

Web

1. inc/functions.php
2. inc/classes/update.class.php
3. install/validation.php
4. pages/admin/dashboard.php

Web

1. Replaced the TinyMCE editor with a self hosted version, in order for it to work again
2. Updated the build chain

Modified files

Web

1. inc/functions.php
2. inc/footer.php
3. compiled/*

Changelog

Web

1. Fixed a display issue where a selected custom action/console command run type option would not show the currently selected option, causing a reset of this option every time you save.

Lua

1. Fixed an issue where the console would spew errors about an invalid SQL syntax on MySQL versions 8 or newer. We used a no longer existent shorthand version of ORDER BY <columns> DESC.

Modified files

Web

1. inc/functions.php
2. inc/classes/options.class.php

Lua

1. lua/prometheus/database.lua

This update contains some PayPal security fixes. Update ASAP!

Web

1. Save Stripe customers for later use
2. Custom jobs code now works properly
3. PayPal security fixes

Modified files

Web

1. inc/functions.php
2. inc/classes/stripe.class.php
3. inc/classes/update.class.php
4. stripe.php
5. pages/store/customjob.php
6. inc/classes/verification.class.php
7. ipn.php

Fixed a critical vulnerability to do with credit purchases where packages cost greater than 1000 credits. Update ASAP.

Web

1. Fixed a critical vulnerability to do with credit purchases where packages cost greater than 1000 credits. Update ASAP.
2. Fixed transferring credits to other users.
3. Fixed an issue where redirecting to Stripe may not work if the ID returned from Prometheus has a space at the beginning.

Modified files

Web

1. inc/credits.php
2. inc/functions.php
3. inc/classes/verification.class.php
4. profile.php
5. store.php
6. pages/store/purchase.php

WARNING: If you are using Stripe you must update your API version in Stripe's dashboard for Stripe to work with this version of Prometheus. You can do so here: https://dashboard.stripe.com/developers

Web

1. Modernized several parts of the code (PHP 7.4 now required).
2. Stripe orders now have metadata set on them. You can search for things like product id, product type, user id and user receiver id.
3. Fixed a problem in the installer where the Stripe keys would not be saved properly.
4. Updated Stripe to the latest API version
5. Fixed styling and text issues on the custom job creation page.
6. Removed all usages of `get_magic_quotes_gpc`

Modified files

Web

1. vendor/*
2. inc/classes/actions.class.php
3. inc/classes/customjob.class.php
4. inc/classes/stripe.class.php
5. inc/classes/steamLogin.class.php
6. pages/store/customjob.php
7. inc/functions.php
8. stripe.php
9. ipnlistener.php
10. a bunch more files, but they are not required

Changelog

1. Fixed an edge case where purchasing with credits would return a blank page if only credits is disabled and no custom price is set.
2. Fixed PHP warnings in phpfastcache and in the credits purchase flow.
3. Updated all our composer dependencies, this should fix some Stripe checkout errors.

Modified files

Web

1. vendor/*
2. inc/classes/coupon.class.php
3. inc/classes/packages.class.php
4. inc/credits.php
5. cache/drivers/files.php
6. cache/drivers/sqlite.php
7. cache/drivers/abstract.php
8. cache/drivers/phpfastcache.php

Changelog

1. Fixed a bug where a free package would be given twice if credits are enabled while "only use credits" is disabled.
2. Fixed a bug where assigning a non-permanent package would throw an error and not assign the package.
3. Fixed a display bug in the dashboard.
4. Added sAdmin support.
5. Fixed QueryS error on the Lua side.

Modified files

Web

1. inc/credits.php
2. inc/functions.php
3. pages/admin/dashboard.php
4. admin/pkg/_actions.php

Lua

1. lua/prometheus/actions.lua
2. lua/prometheus/database.lua