This is a critical update. Please upgrade immediately. Under 3.1.3, valid crypto payments were not being confirmed. 3.1.4 fixes the webhook pipeline end-to-end.
Critical fixes
- Corrected the webhook/callback URL shown on the payment profile. It previously pointed at the admin router (admin.php?payment_callback…), so webhooks never reached XenForo and payments never completed. It now shows the correct https://<board>/payment_callback.php?_xfProvider=Crypoverse.
- Replaced HMAC validation with UUID-based authentication. Crypoverse webhooks aren't HMAC-signed, so the 3.1.3 check rejected every real webhook. Each webhook is now matched to a pending purchase request by its unguessable UUID, with the amount always taken from that request, never the webhook, so a forged webhook can't alter it.
- Fixed a fatal TypeError on the callback endpoint ($logDetails was passed as null). Affected XF 2.0–2.3.
- Opening the callback URL directly in a browser now returns a friendly notice instead of logging an error.
Logging & reliability
- Incoming webhook receipts now appear in the Payment Provider Log (not just initiations); routine receipts no longer spam the server error log.
- Payment amount is now taken from the purchase request, removing a brittle fiat amount-mismatch check that could falsely reject non-USD payments.
- Fixed the underpaid handler crashing on PHP 8.
- Fixed local transaction audit rows never saving (column-mapping fix).
- Fixed the payment status page lookup to match the stored metadata format.
Upgrade notes: Upload the package and run the upgrade from the Admin CP (no config changes required). After upgrading, open your Crypoverse payment profile and confirm the displayed webhook URL now ends in
payment_callback.php?_xfProvider=Crypoverse, and that it matches the URL set in your Crypoverse dashboard.
Code & Compliance