From 5a925f878437103ae68fc1a986e3120c56d12212 Mon Sep 17 00:00:00 2001
From: Wrongecho <bcf8c9f2@opayq.com>
Date: Sun, 30 Aug 2026 15:12:14 +0100
Subject: [PATCH] Move payment provider post vars to a model to reduce
 repetition

---
 admin/post/payment_provider.php       | 15 +++------------
 admin/post/payment_provider_model.php |  9 +++++++++
 2 files changed, 12 insertions(+), 12 deletions(-)
 create mode 100644 admin/post/payment_provider_model.php

diff --git a/admin/post/payment_provider.php b/admin/post/payment_provider.php
index 8500aeaf3..cc5d05ad2 100644
--- a/admin/post/payment_provider.php
+++ b/admin/post/payment_provider.php
@@ -11,12 +11,7 @@ if (isset($_POST['add_payment_provider'])) {
     validateCSRFToken();
 
     $provider = escapeSql($_POST['provider']);
-    $public_key = escapeSql($_POST['public_key']);
-    $private_key = escapeSql($_POST['private_key']);
-    $threshold = floatval($_POST['threshold']);
-    $account = intval($_POST['account']);
-    $expense_vendor = intval($_POST['expense_vendor']) ?? 0;
-    $expense_category = intval($_POST['expense_category']) ?? 0;
+    require_once 'payment_provider_model.php';
 
     // Check to ensure provider isn't added twice
     $sql = mysqli_query($mysqli, "SELECT 1 FROM payment_providers WHERE payment_provider_name = '$provider' LIMIT 1");
@@ -53,13 +48,9 @@ if (isset($_POST['edit_payment_provider'])) {
 
     validateCSRFToken();
 
+    require_once 'payment_provider_model.php';
+
     $provider_id = intval($_POST['provider_id']);
-    $public_key = escapeSql($_POST['public_key']);
-    $private_key = escapeSql($_POST['private_key']);
-    $threshold = floatval($_POST['threshold']);
-    $account = intval($_POST['account']);
-    $expense_vendor = intval($_POST['expense_vendor']) ?? 0;
-    $expense_category = intval($_POST['expense_category']) ?? 0;
 
     mysqli_query($mysqli,"UPDATE payment_providers SET payment_provider_public_key = '$public_key', payment_provider_private_key = '$private_key', payment_provider_threshold = $threshold, payment_provider_account = $account, payment_provider_expense_vendor = $expense_vendor, payment_provider_expense_category = $expense_category WHERE payment_provider_id = $provider_id");
 
diff --git a/admin/post/payment_provider_model.php b/admin/post/payment_provider_model.php
new file mode 100644
index 000000000..a0a42785b
--- /dev/null
+++ b/admin/post/payment_provider_model.php
@@ -0,0 +1,9 @@
+<?php
+defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
+
+$public_key = escapeSql($_POST['public_key']);
+$private_key = escapeSql($_POST['private_key']);
+$threshold = floatval($_POST['threshold']);
+$account = intval($_POST['account']);
+$expense_vendor = intval($_POST['expense_vendor']) ?? 0;
+$expense_category = intval($_POST['expense_category']) ?? 0;
\ No newline at end of file