Same bug class as the awardPoints() fix - :q was reused three times in one
WHERE clause, which fails under real (non-emulated) prepared statements.
Split into distinct :q1/:q2/:q3 placeholders each bound to the same value.
(The other flagged file, admin/import-export.php, turned out to be a false
positive from the earlier scan - the duplicate ":checked"/"::before" matches
were CSS pseudo-selectors inside a <style> block, not SQL placeholders.)
Feature: checkout.php now lets logged-in customers apply existing wallet
balance or redeem a gift card code (which tops up wallet first, then
applies) toward their order total. Deduction is deferred to payment
success (markSquarePaymentResult in includes/square.php), never at order
creation, so an abandoned checkout never loses real wallet money - mirrors
how loyalty points already work here, unlike stock which is decremented
eagerly. payment.php gains a second Square Gift Card tab (payments.giftCard()
SDK method) alongside the card form, both hitting the same
create-square-payment.php endpoint since Square treats both source types
identically.
New api/apply-wallet-credit.php validates/quotes an amount without writing
anything - actual spend happens only via markSquarePaymentResult(). The
gift-card-to-wallet transaction logic was extracted out of
api/redeem-gift-card.php into a shared loyalty()->redeemGiftCardToWallet()
so the Wallet page and checkout both call the same code.
Also fixed three unrelated pre-existing bugs surfaced while testing this:
- loyalty.php awardPoints() reused the same named PDO parameter (:points)
twice in one UPDATE - fails under real prepared statements, meaning
loyalty points (and the email sent right after them) were silently never
awarded for any order tied to a logged-in customer.
- redeemGiftCardToWallet (formerly inline in redeem-gift-card.php) referenced
a gift_cards.updated_at column that does not exist in the schema, and used
invalid enum values (gift_card_transactions.type=redeem,
wallet_transactions.type=gift_card) that do not match the actual enum
definitions - gift card redemption has likely never worked at all.
- account/rewards.php was missing the line that loads
account.css, unlike every other account/*.php page, so its sidebar/layout
rendered unstyled.
Consolidates payment processing onto the same Square account already used by
tomtomgames.com and parkerslingshotrentals.com. Collapses the two prior parallel
Stripe flows (hosted Checkout + embedded Elements) into a single Square Web
Payments SDK flow, since Payments API is synchronous and removes the original
reason for two paths.
- includes/square.php: squareApi() cURL helper (mirrors the pattern already
used on parkerslingshotrentals.com), markSquarePaymentResult() as the single
source of truth for order completion shared by the sync response, webhook,
and reconciliation poll - fixes a pre-existing bug where loyalty points were
only ever awarded from the polling endpoint, never from the webhook.
- api/create-square-payment.php replaces api/create-payment-intent.php;
api/create-checkout-session.php deleted (no Square equivalent - single flow).
- api/webhook.php rewritten for Squares signature scheme and event types.
- api/payment-status.php repurposed to reconciliation-only fallback.
- payment.php branches on PAYMENT_PROCESSOR so Stripe and Square code coexist
deployed while dormant - flipping one config constant is the cutover/rollback.
- admin/payments.php: added a Square settings card alongside the existing
(now legacy-labeled) Stripe card.
- db/schema.sql + live DB: added square_payment_id/square_order_id columns,
stripe_* columns kept for historical orders.
Not yet cut over - PAYMENT_PROCESSOR still defaults to stripe in
config-secrets.php (outside this repo). Sandbox testing still needed before
flipping to square/production.
- admin/api/upload-splash.php had NO admin-auth check (included the public
customer header, not admin/includes/header.php) and both upload endpoints
trusted the client-supplied MIME type and filename extension, so an
attacker could name a file "shell.php", spoof Content-Type: image/png,
and get PHP written into a web-reachable uploads/ directory. Added
AdminAuth check and centralized real-content validation (getimagesize +
server-side extension mapping) in a new handleImageUpload() helper used
by both admin/upload-image.php and admin/api/upload-splash.php.
- Removed CURLOPT_SSL_VERIFYPEER => false from the CyberMail email calls
in includes/email.php and includes/functions.php (MITM risk on the API
key). Rewrote functions.php's sendEmail() as a thin wrapper around
Email::send() so there's one implementation instead of two that could
drift (this is what had the second copy of the TLS bypass).
- Escaped customer-controlled fields (customer_name, tracking info, reset
URL) before interpolating into outbound HTML emails — name is free text
from registration/checkout with no length/char restriction, so it was
stored-HTML-injectable into every transactional email.
- Fixed api/redeem-gift-card.php referencing a nonexistent `balance` column
on gift_cards (actual column is current_balance) — gift card redemption
was completely broken, always returning "no remaining balance".
- Fixed api/submit-review.php inserting into nonexistent `content`/`status`
columns on reviews (actual columns are `comment`/`is_approved`) — review
submission was crashing on every request.
- Hardened .htaccess: block /db/*, /.git/*, and *.sql. Live site currently
serves db/schema.sql and the full .git directory (including .git/config,
which contains a GitHub PAT with push access) over HTTP — the existing
config/includes RedirectMatch rules are also not being enforced live,
see report for details; this needs a server-level fix too.
- Cleaned up README's leftover install instructions pointing at a deleted
create-admin.php with a documented default password.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- LoyaltyProgram now loads tiers from loyalty_tiers DB table in constructor
with fallback to hardcoded defaults if table is empty
- awardPoints() accepts order_id param with duplicate-prevention check so
points cannot be double-awarded for the same order
- Inserts balance_after into loyalty_transactions for accurate history
- payment-status.php: award points after Stripe checkout session or
PaymentIntent confirmed as paid
- create-checkout-session.php: award points in demo mode payment path
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
DB column is stripe_session_id but code was writing to stripe_checkout_session,
causing a 500 on checkout and breaking payment status checks.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Mirrors the checkout.session.completed case which checks
payment_status === paid before acting. Now checks data.status
=== succeeded on the PaymentIntent object, consistent with how
Stripe structures the event and defensive against any future
edge case where the event fires in a non-final state.
Replaced local sendOrderConfirmationEmail() with emailService()->sendOrderConfirmation().
Order confirmations now log to email_log table and use the branded template
(orange header, full subtotal/tax/discount breakdown) instead of the minimal
brown-header version that was invisible to the admin Email Log.
When using Stripe Checkout, both checkout.session.completed and
payment_intent.succeeded fire for the same payment. After the stripe.php
change propagated order_id into PI metadata, the PI handler also found
an order_id and sent a second confirmation email.
Fix: fetch the order first in payment_intent.succeeded and skip if
already confirmed. Also records stripe_payment_intent in this path
for direct PI flows that bypass checkout.session.completed.
Myron Blair
myron