Changeset 3757857 for wallet-up/trunk/src/API/WebhookHandler.php

Timestamp:

10/21/2026 07:26:01 AM (3 weeks ago)

Author:

walletup

Message:

6.3.6: correct edition labels and licence reminder; safer Stripe payment updates

File:

• wallet-up/trunk/src/API/WebhookHandler.php (modified) (2 diffs)

wallet-up/trunk/src/API/WebhookHandler.php

@@ -481 +481 @@
             }
 
+            if (!$isTestMode && empty($event->livemode)) {
+                $this->errorHandler->log('Stripe webhook ignored: a test-mode event (' . $event->type . ') reached a store that takes live payments');
+                $this->updateWebhookStatus($webhookId, 'completed', 200, microtime(true) - $startTime, 'Test-mode event ignored on a live store');
+                return new WP_REST_Response(['success' => true, 'ignored' => 'test_mode_event'], 200);
+            }
+
             $eventType = $event->type;
             $object = $event->data->object;
@@ -606 +612 @@
         if ($orderKey && $order->get_order_key() !== $orderKey) {
             $this->errorHandler->log("Stripe webhook: order key mismatch for order {$orderId}");
+            return;
+        }
+
+        $paidMinor = (int) ($paymentIntent->amount_received ?? $paymentIntent->amount ?? 0);
+        $dueMinor = \WalletUpPro\Core\Payments\PaymentGatewayHandler::toMinorUnits((float) $order->get_total(), (string) $order->get_currency());
+        $sameCurrency = strtolower((string) ($paymentIntent->currency ?? '')) === strtolower((string) $order->get_currency());
+        if (!$order->is_paid() && (!$sameCurrency || $paidMinor < $dueMinor)) {
+            $this->errorHandler->log("Stripe webhook: PaymentIntent {$paymentIntent->id} does not cover order {$orderId}; order left unpaid");
+            /* translators: %s: Stripe PaymentIntent ID */
+            $order->add_order_note(sprintf(esc_html__('Stripe reported a payment (PaymentIntent: %s) that does not match this order total, so the order was not marked as paid.', 'walletup'), $paymentIntent->id));
+            $order->save();
             return;
         }