Improving Payment Failure Logging

Improved Payment Failure Logging

This update adds detailed logging for failed payment requests.

When a payment request fails, the plugin now records the available failure reason and related error details, making it easier to identify payment issues, troubleshoot gateway responses, and resolve transaction problems faster.

What's New

• Added logging for failed payment requests
• Displays available payment failure reasons
• Improved troubleshooting for gateway and transaction errors
• Makes payment-related issues easier to diagnose

v1.1.0 - Security update: server-side payment verification

⚠️ Security release — update as soon as possible

This release fixes a vulnerability that allowed invoices to be marked
paid without a completed payment. All previous versions are affected,
including v1.0.1. Every WHMCS store using this gateway should update.

Full technical details will be published in a security advisory once
merchants have had time to upgrade.

---

Required after updating

1. Upload both files, replacing the existing ones:
   • modules/gateways/paymento.php
   • modules/gateways/callback/paymento.php
2. Go to Setup → Payment Gateways → Manage Existing Gateways, then
   Save Changes on Paymento — even if you change nothing.

Step 2 is required, not optional. It re-registers your IPN URL with
Paymento. If your WHMCS is installed in a subdirectory, the URL
registered by earlier versions was wrong and payment notifications were
never reaching your store.

Note: the gateway will now refuse to save unless both the API Key and
the Secret Key are filled in. The Secret Key is what authenticates
payment notifications — a blank one is why some stores silently
received none.

---

Security

• Invoice settlement now requires confirmation from the Paymento API.
  Payment status is no longer taken from request parameters.
• Payments are bound to the invoice they were created for, so a token
  for one invoice cannot settle another.
• The credited amount comes from the verified API response and is never
  left blank.
• Duplicate and replayed notifications can no longer credit an invoice
  more than once.
• Invoices placed through other gateways are no longer touched.
• cURL requests now set explicit timeouts and TLS certificate
  verification.

Fixed

• Payment notifications were rejected on some servers. The IPN
  signature header was matched against two hardcoded spellings;
  getallheaders() normalises header case differently depending on the
  PHP SAPI, so valid notifications failed on Apache mod_php. Now matched
  case-insensitively.
• IPN URL was wrong on subdirectory installs. It was built from
  $_SERVER['HTTP_HOST'] assuming the document root. Now derived from
  your configured SystemURL.
• Invoice lookups could fail outright on some WHMCS versions due to
  a column that does not exist in every schema.
• A late or replayed rejection could move a paid invoice back to unpaid.

Changed

• Every callback outcome is now recorded in Billing → Gateway Log,
  including the underlying error when something fails. If you are
  troubleshooting, start there — an empty log means the request never
  reached your store.
• The customer return page distinguishes "paid" from "payment received,
  awaiting confirmation" instead of implying success either way.

---

Requires: WHMCS 7.0+, PHP 7.2+

Paymento WHMCS Module

Full Changelog: v1.0.0...v1.0.1

Paymento WHMCS Module

This module allows WHMCS merchants to accept Bitcoin, Ethereum, USDT, and more directly into their wallets without intermediaries. Secure, non-custodial, and easy to integrate!

Installation Instructions:
1️⃣ Download the latest release file from below.
2️⃣ Extract the ZIP file.
3️⃣ Upload the modules folder to your WHMCS root directory.
4️⃣ In WHMCS Admin Panel, go to Setup > Payment Gateways.
5️⃣ Find "Paymento", click Activate, and enter your API credentials.
6️⃣ Save Changes, and you're ready to accept crypto payments!

Requirements:
✔ WHMCS 7.0+
✔ PHP 7.2+
✔ cURL enabled
✔ A Paymento Merchant Account

🔹 Need Help? Open an issue in this repository or contact our support team.