Version 7

Version 7.6.8

Version 7.6.8 is a security release, and all Payage users should upgrade to it. The full release notes are in the Payage support forum.

Security

Earlier versions displayed stored data in the administrator pages without escaping it. Someone with no account on your site could plant script that would then run in an administrator's browser when they opened Payage. This could happen in two ways:

  • Payer names, addresses, emails, product names and browser details from a payment were shown as raw HTML on the payment pages.
  • A request to a gateway callback URL with an unknown transaction ID is recorded in the System Log with its full URL and POST data, and the log page showed this as raw HTML.

Every value that comes from the database or from a request is now escaped before it is shown in the administrator pages. System Log details and gateway status messages can still contain line breaks and preformatted text, but any other HTML is shown as text. This also applies to entries that were already in the log.

Template Overrides

The administrator and front end pages now use Joomla's standard layout files, so you can override any of them in your template:

Side Layout files Override location
Administrator administrator/components/com_payage/tmpl/view/ administrator/templates/template/html/com_payage/view/
Front end components/com_payage/tmpl/view/ templates/template/html/com_payage/view/

The administrator views are about, account, config, payment, reports, styles and syslog. The front end views are invoice and test. Existing menu items keep working.

Bug Fixes

  • Opening an invoice entry in the System Log no longer causes an error.
  • The Country Sales report shows the correct message when there is no data for the map.
  • A failed version check on the About page is now handled instead of causing an error.
  • Some small HTML errors on the About page, the Sales by Month report and the Variables tab of the Configuration page have been fixed.

Upgrading

Install 7.6.8 over your existing version in the usual way. Your payments, accounts and settings are not changed. If any System Log entries contain HTML other than line breaks and preformatted text, you will now see the HTML tags as text. For example, a database error entry shows its SQL query exactly as it was run.