From 318eb7cf77b77cf178b20decda87af01889865d6 Mon Sep 17 00:00:00 2001
From: Wrongecho <bcf8c9f2@opayq.com>
Date: Sun, 30 Aug 2026 15:06:32 +0100
Subject: [PATCH] Stripe - Warn the user if the secret key is not valid during
 provider add/edit

---
 .../payment_provider_edit.php                 |  1 +
 admin/post/payment_provider.php               | 29 +++++++++++++++++--
 guest/guest_pay_setup_stripe_customer.php     |  4 +--
 3 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/admin/modals/payment_provider/payment_provider_edit.php b/admin/modals/payment_provider/payment_provider_edit.php
index 9426af6c1..6600d2894 100644
--- a/admin/modals/payment_provider/payment_provider_edit.php
+++ b/admin/modals/payment_provider/payment_provider_edit.php
@@ -28,6 +28,7 @@ ob_start();
 <form action="post.php" method="post" autocomplete="off">
     <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="provider_id" value="<?= $provider_id ?>">
+    <input type="hidden" name="provider" value="<?= $provider_name ?>">
 
     <div class="modal-body">
 
diff --git a/admin/post/payment_provider.php b/admin/post/payment_provider.php
index d24884969..8500aeaf3 100644
--- a/admin/post/payment_provider.php
+++ b/admin/post/payment_provider.php
@@ -1,7 +1,7 @@
 <?php
 
 /*
- * ITFlow - GET/POST request handler for AI Providers ('ai_providers')
+ * ITFlow - GET/POST request handler for payment Providers ('payment_providers')
  */
 
 defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
@@ -29,7 +29,19 @@ if (isset($_POST['add_payment_provider'])) {
 
     $provider_id = mysqli_insert_id($mysqli);
 
-    logAudit("Payment Provider", "Create", "$session_name created AI Provider $provider");
+    logAudit("Payment Provider", "Create", "$session_name created Payment Provider $provider");
+
+    // Check Stripe sk
+    if ($provider === 'Stripe') {
+        try {
+            require_once '../includes/stripe_init.php';
+            $stripe = new \Stripe\StripeClient($private_key);
+            $account = $stripe->accounts->retrieve();
+        } catch (Exception $e) {
+            flashAlert("Error checking Stripe key: " . $e->getMessage(), 'error');
+            redirect();
+        }
+    }
 
     flashAlert("Payment provider <strong>$provider</strong> created");
 
@@ -42,7 +54,6 @@ if (isset($_POST['edit_payment_provider'])) {
     validateCSRFToken();
 
     $provider_id = intval($_POST['provider_id']);
-    $description = escapeSql($_POST['description']);
     $public_key = escapeSql($_POST['public_key']);
     $private_key = escapeSql($_POST['private_key']);
     $threshold = floatval($_POST['threshold']);
@@ -54,6 +65,18 @@ if (isset($_POST['edit_payment_provider'])) {
 
     logAudit("Payment Provider", "Edit", "$session_name edited Payment Provider $provider");
 
+    // Check Stripe sk
+    if ($_POST['provider'] === 'Stripe') {
+        try {
+            require_once '../includes/stripe_init.php';
+            $stripe = new \Stripe\StripeClient($private_key);
+            $account = $stripe->accounts->retrieve();
+        } catch (Exception $e) {
+            flashAlert("Error checking Stripe key: " . $e->getMessage(), 'error');
+            redirect();
+        }
+    }
+
     flashAlert("Payment Provider <strong>$provider</strong> edited");
 
     redirect();
diff --git a/guest/guest_pay_setup_stripe_customer.php b/guest/guest_pay_setup_stripe_customer.php
index 84136d8e8..1cb1d8a9c 100644
--- a/guest/guest_pay_setup_stripe_customer.php
+++ b/guest/guest_pay_setup_stripe_customer.php
@@ -79,14 +79,14 @@ if (isset($_GET['invoice_id'], $_GET['url_key'])) {
 
                         <div class="mb-3">
                             <div class="form-floating">
-                                <input type="text" class="form-control" id="stripe_name" name="name" placeholder="Name" autocomplete="name" required>
+                                <input type="text" class="form-control" id="stripe_name" name="name" placeholder="Name" autocomplete="name" maxlength="80" required>
                                 <label for="stripe_name">Your Name</label>
                             </div>
                         </div>
 
                         <div class="mb-3">
                             <div class="form-floating">
-                                <input type="email" class="form-control" id="stripe_email" name="email" placeholder="Email" autocomplete="email" required>
+                                <input type="email" class="form-control" id="stripe_email" name="email" placeholder="Email" autocomplete="email" maxlength="80" required>
                                 <label for="stripe_email">Your Email</label>
                             </div>
                         </div>