Payage 7.6.8 is a security release: all Payage users should upgrade. It also moves the admin pages to Joomla's standard layout files, so they can now be overridden in your template.

Security

Earlier versions displayed stored data in the administrator pages without escaping it. Someone with no account on your site could plant script that would then run in an administrator's browser when they opened Payage. There were two ways in:

  • Checkout details. Payer names, addresses, emails, product names and browser details are entered or sent during a payment, and were shown as raw HTML on the payment list and payment detail pages.
  • The system log. A request to a gateway callback URL with an unknown transaction ID is logged with its full URL and POST data, and the log page displayed that as raw HTML.

In 7.6.8:

  • Every value that comes from the database or from a request is escaped before it is shown in the admin pages: payments, unconfirmed payments, accounts, the system log, reports and the filter dropdowns.
  • System log details and gateway status messages may keep simple line breaks (<br>) and preformatted blocks (<pre>). All other HTML is shown as text. Entries already in your log are made safe too, without any database change.
  • The payment list's sort column and direction are checked against the allowed values.
  • The reports page only runs the seven listed reports. Previously it would call any method named in the URL.

Template overrides

The admin pages now use Joomla's standard layout files, so any of them can be overridden in your administrator template. Before, their HTML was built inside the view classes and could not be changed without editing Payage itself.

Side

Layout files

Override location

Administrator

administrator/components/com_payage/tmpl/<view>/<layout>.php

administrator/templates/<template>/html/com_payage/<view>/

Site

components/com_payage/tmpl/<view>/<layout>.php

templates/<template>/html/com_payage/<view>/

The administrator views are about, account, config, payment, reports, styles and syslog. The site views are invoice and test. The site menu item definitions moved from components/com_payage/views to components/com_payage/tmpl. Existing menu items keep working.

Bug fixes

Area

Fix

System log

Opening an invoice log entry no longer causes an error.

Reports

Country Sales shows the correct message when there is no data for the map.

Reports

Sales by Month no longer outputs a stray closing form tag.

About

The page no longer outputs a stray table cell.

About

A failed version check is now handled instead of causing an error. Errors of this kind are also handled in the models and helpers.

Configuration

The Variables tab no longer shows an empty extra table when the number of variables is even.

Upgrading

Install 7.6.8 over your existing version in the usual way. Your payments, accounts and settings are not changed.

  • Old folders. The installer removes the old components/com_payage/views folder automatically.
  • Log display. System log entries and gateway status messages that contain HTML other than line breaks and preformatted text now show the tags as text. For example, a database error entry shows the SQL query exactly as it was run.
  • Gateways. The gateway add-ons are released separately. Nothing they rely on has changed in this release.