Stripe.com payment integration module

[Reesy]

Ignore the above, tested it with Japanese OS, it works perfectly.
I wonder why they need Country Japan at the bottom of the form though... seems unnecessary

[balihr]

using ZC 2.1.0 with OPC. PayPal payments accepted through Stripe.
Payment attempts were failing with the following error:

You must provide a `return_url` when confirming a PaymentIntent with the payment method type paypal.

Had to modify includes/modules/payment/stripepay/create.php
from

$jason_FormLayout = json_encode(MODULE_PAYMENT_STRIPE_LAYOUT);
$confirmationURL = '"' . HTTPS_SERVER . DIR_WS_HTTPS_CATALOG . 'index.php?main_page=checkout_confirmation"';

to

$jason_FormLayout = json_encode(strtolower(MODULE_PAYMENT_STRIPE_LAYOUT));
$confirmationURL = HTTPS_SERVER . DIR_WS_HTTPS_CATALOG . 'index.php?main_page=checkout_confirmation';

First line change was related to another error being thrown...

[royaldave]

This plugin says it only works for US and Canadian bank account holders - but that was a statement made in 2012.

Is this still the case - a few posts back I see someone based in Japan is evidently using it?

[dbltoe]

Stripe now claims to be global.

[flappingfish]

Apparently this module relies on the user returning to the website to note the payment was a success and there is no webhook file which can result in an order being placed and paid for but not being recorded??

Stripe library has a "webhook.php" which apparently isn't the file i should point too in stripes dashboard under webhooks settings?

I have had a number of these unrecorded orders and always put it down to checkout rush but on another site with the same module and no checkout rush issues i found a revolut payment was taken from my customer but the system treated it like they had not paid and their basket remained filled with the items.

Do I set the url to '/checkout_success' or does this module require a "/stripe_webhook.php" as chatgpt suggests? (provided below but... the code it provided for this looks like it has placeholders and a few details wrong.. made up functions ect lol)

<?php
// /stripe_webhook.php
// Minimal Stripe webhook for Zen Cart

chdir(__DIR__);
require 'includes/application_top.php'; // boot Zen Cart (DB, constants)
require 'includes/modules/payment/stripepay/vendor/autoload.php';

$endpointSecret = getenv('STRIPE_WEBHOOK_SECRET') ?: 'whsec_PUT_YOUR_SECRET_HERE';

// Simple health-check for you
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
  header('Content-Type: text/plain'); echo "ok\n"; exit;
}

$payload = @file_get_contents('php://input');
$sig     = $_SERVER['HTTP_STRIPE_SIGNATURE'] ?? '';

try {
  $event = \Stripe\Webhook::constructEvent($payload, $sig, $endpointSecret);
} catch (\UnexpectedValueException $e) {
  http_response_code(400); echo 'Invalid payload'; exit;
} catch (\Stripe\Exception\SignatureVerificationException $e) {
  http_response_code(400); echo 'Invalid signature'; exit;
}

$type   = $event['type'] ?? '';
$object = $event['data']['object'] ?? [];

function zc_log($m){ error_log('[stripewh] '.$m."\n", 3, __DIR__.'/logs/stripe_webhook.log'); }

switch ($type) {
  case 'payment_intent.succeeded':
    $pi   = $object;
    $txn  = $pi['id'] ?? '';
    $amt  = isset($pi['amount_received']) ? ($pi['amount_received']/100.0) : 0;
    $cur  = strtoupper($pi['currency'] ?? '');
    $oid  = $pi['metadata']['zc_order_id'] ?? $pi['metadata']['order_id'] ?? null;
    if ($oid) {
      $orders_id = (int)$oid;
      $rs = $db->Execute("SELECT orders_status FROM " . TABLE_ORDERS . " WHERE orders_id=$orders_id LIMIT 1");
      if (!$rs->EOF) {
        $paid_status_id = defined('MODULE_PAYMENT_STRIPEPAY_ORDER_STATUS_PAID_ID')
          ? (int)MODULE_PAYMENT_STRIPEPAY_ORDER_STATUS_PAID_ID : 2; // adjust to your "Paid" status
        if ((int)$rs->fields['orders_status'] !== $paid_status_id) {
          $db->Execute("UPDATE " . TABLE_ORDERS . " SET orders_status=$paid_status_id, last_modified=NOW() WHERE orders_id=$orders_id");
          $db->Execute("INSERT INTO " . TABLE_ORDERS_STATUS_HISTORY . " (orders_id, orders_status_id, date_added, customer_notified, comments)
                        VALUES ($orders_id, $paid_status_id, NOW(), 0, 'Stripe PI ".$txn."  ".$amt." ".$cur." (webhook)')");
        }
      } else {
        zc_log("order $orders_id not found for txn $txn");
      }
    } else {
      zc_log("no order_id metadata for txn $txn");
    }
    break;

  case 'checkout.session.completed':
    $cs  = $object;
    $oid = $cs['metadata']['zc_order_id'] ?? null;
    $txn = is_array($cs['payment_intent'] ?? null) ? ($cs['payment_intent']['id'] ?? '') : ($cs['payment_intent'] ?? '');
    if ($oid) {
      $orders_id = (int)$oid;
      $paid_status_id = defined('MODULE_PAYMENT_STRIPEPAY_ORDER_STATUS_PAID_ID')
        ? (int)MODULE_PAYMENT_STRIPEPAY_ORDER_STATUS_PAID_ID : 2;
      $db->Execute("UPDATE " . TABLE_ORDERS . " SET orders_status=$paid_status_id, last_modified=NOW() WHERE orders_id=$orders_id");
      $db->Execute("INSERT INTO " . TABLE_ORDERS_STATUS_HISTORY . " (orders_id, orders_status_id, date_added, customer_notified, comments)
                    VALUES ($orders_id, $paid_status_id, NOW(), 0, 'Stripe Checkout ".$txn." (webhook)')");
    } else {
      zc_log("checkout.session.completed without order id");
    }
    break;

  default:
    // ignore others
}

http_response_code(200);
echo 'ok';

[nousch]

Apparently this module relies on the user returning to the website to note the payment was a success and there is no webhook file which can result in an order being placed and paid for but not being recorded??

Stripe library has a "webhook.php" which apparently isn't the file i should point too in stripes dashboard under webhooks settings?

I have had a number of these unrecorded orders and always put it down to checkout rush but on another site with the same module and no checkout rush issues i found a revolut payment was taken from my customer but the system treated it like they had not paid and their basket remained filled with the items.

Do I set the url to '/checkout_success' or does this module require a "/stripe_webhook.php" as chatgpt suggests? (provided below but... the code it provided for this looks like it has placeholders and a few details wrong.. made up functions ect lol)

I've been looking into this as well, and my conclusion is that it's more complicated than you might think.

Basically the idea is that you can use a webhook to catch successful payments when the customer for some reason doesn't return to the confirmation page, and let the server handle the order.

Setting the webhook url to the success page won't do the trick because you want the payment to be processed first. Setting it to the confirmation page won't work either, because there's no customer, so there's no session, and nothing will be processed.

In theory you could set it to the confirmation page (or directly to main_page=checkout_process) with the session id in the url to restore the session, and thus make the necessary information available to process the order. However, there's no customer logged in, so stripe will be thrown out. You might circumvent that, and write an alternative checkout_process module, but I think you must really know what you are doing to keep that secure.

There could be another reason for these unrecorded orders though. You might want to make sure that the process for return based payment methods is working correctly, because for me it wasn't.

I encountered three problems:

1. As already pointed out by bahlir, the $confirmationURL needs to be changed or you will get an error

2. If you require conditions to be checked, the conditions will not be posted when the customer returns to the page, and will be redirected to the payment page,

I fixed that with a check in the header.php

$stripeRedirect = false;

if (isset($_GET['redirect_status'])) $stripeRedirect = true; 

if (DISPLAY_CONDITIONS_ON_CHECKOUT == 'true' && !$stripeRedirect) {
  if (!isset($_POST['conditions']) || ($_POST['conditions'] != '1')) {
    $messageStack->add_session('checkout_payment', ERROR_CONDITIONS_NOT_ACCEPTED, 'error');
  }
}

3. When the customer is redirected to the confirmation page the javascript variables set by create.php have gone out of scope. Without a PublishableKey the script will return an error and nothing happens. I was able to fix that by redeclaring this variable in the jscript_stripe.php when $stripeRedirect is true, but there is probably a more elegant solution, if you know more about Javascript than I do.

I'm testing the Stripe.com payment integration module using ZC 2.1.0 without OPC, but it's possible that you have the same problem in your setup, and that might be another reason why orders have been paid for but are not processed.

You need to choose a redirect based payment method to test this. I'm now testing IDEAL, a payment method that is popular in the Netherlands.

[james_japan]

Yes that statement is donkeys years old, Stripe is pretty much global and defo works in Japan :)

[barco57]

zc2.10
bootstrap
php8.3

So far unable to get an order to generate in the cart. Everything else appears to be working, no errors on screen, credit card fields appear correctly, click the button and get the spinner, transaction is generated in the Stripe dashboard, and money taken from my account. it is just the order generation in the cart that never happens.

[flappingfish]

sounds like the same issue i "occasionally" get. customers will ring me and inform me they checked out, got charged and never got an order confirmation. ZXPOS is quite useful for these instances, simply log in as customer and push basket through as instore card payment once strip payment confirmed. possible you have not updated the module with the correct files for 2.1 there is a different file set i believe. I think your issue resides in having the wrong version of stripe_create.php (I think that is the correct filename) If you have the wrong file i think your sql queries will be associated to older database namings, the mismatch in names results in a silent failure caused by bad sql query i think?

[barco57]

I am using the latest here: https://www.zen-cart.com/downloads.php?do=file&id=1548