Payment callbacks completely broken after upgrade to 2.2.13 Patch 2

[Jake B.]

Getting this error:

    ParseError: syntax error, unexpected token "const" src/XF/Payment/CallbackState.php:25 

    Generated by: Unknown account Sep 19, 2026 at 12:23 PM 

Stack trace

#0 src/vendor/composer/ClassLoader.php(427): Composer\Autoload\{closure}('/mnt/nfs/db1/da...')
#1 src/XF/Payment/Stripe.php(686): Composer\Autoload\ClassLoader->loadClass('XF\\Payment\\Call...')
#2 payment_callback.php(33): XF\Payment\Stripe->setupCallback(Object(XF\Http\Request))
#3 {main}

In src/XF/Payment/CallbackState.php it has:

<?php

namespace XF\Payment;

/**
 * @property \XF\Entity\PurchaseRequest $purchaseRequest
 * @property \XF\Purchasable\AbstractPurchasable $purchasableHandler
 * @property \XF\Entity\PaymentProfile $paymentProfile
 * @property \XF\Entity\User $purchaser;
 *
 * @property int $paymentResult
 *
 * @property string $requestKey
 *
 * @property string $transactionId
 * @property string $subscriberId
 * @property string $paymentCountry
 *
 * @property string $logType
 * @property string $logMessage
 * @property array $logDetails
 * @property int $httpCode
 */
#[\AllowDynamicProperties]
const USE_FUNCTION_PLACEHOLDER = true;

class CallbackState
{

All health checks pass, so it seems like this dev tools line was left in the released version. Seems like this is the only file which has this that I can find (other than the CLI command used to add it).
Have had multiple users lose their subscription status because of this, so stuck fixing that too now.

 

[Jake B.]

After going through all of the other sites we've done upgrades to 2.2.13 Patch 2 on (and 2.3.13 for safe measure), none of them upgraded before Thursday have this extra line, both of the two sites we did on Thursday do have it, but a new download of the version from today does not. No idea how long this version would've been active for, the others we did were the week prior, but it seems like at some point someone discovered this issue and did a silent patch for it, and for whatever reason deemed it unworthy of a version bump so people would be able to catch it before having subscriptions break

 

[Jake B.]

Just to make this whole thing even more weird, if I use the XF API that is used by the one-click upgrade to download this release zip again with the license key of one of the two impacted sites I was able to replicate this extra line in that file still, so something very strange is definitely going on. I do not have login details for the XF customer account to download the file from there to see if it matches there, but when I download the same version from another XF license it does not have this extra line. So I guess now we have to concern ourselves with the fact that maybe one random site we upgrade is going to break in some obscure way because for some reason the shipped builds of the same version are different for different licenses for some reason.

This is the CLI command with the license key stripped:

  curl -X POST "https://xenforo.com/api/upgrade-download.json" \
  -H "XF-LICENSE-API-KEY: [snipped]" \
  -d "board_url=https://localhost" \
  -d "addon_id=XF" \
  -d "version_id=2021372" \
  -d "release_date=0" \
  -d "stable_only=1" \
  -d "license_agreement_accepted=1" \
  --remote-header-name \
  --remote-name

 

[Chris D]

The affected download packages have been patched.

This affected the following versions:

• 2.2.12 p1
• 2.2.12 p2
• 2.2.13 p1
• 2.2.13 p2
• 2.2.15 p1
• 2.2.15 p2

You can patch manually with the new download using src/XF/Payment/CallbackState.php and src/addons/XF/hashes.json.

Thanks for flagging it!

 

[Jake B.]

The affected download packages have been patched.

This affected the following versions:

• 2.2.12 p1
• 2.2.12 p2
• 2.2.13 p1
• 2.2.13 p2
• 2.2.15 p1
• 2.2.15 p2

You can patch manually with the new download using src/XF/Payment/CallbackState.php and src/addons/XF/hashes.json.

Thanks for flagging it!

Makes sense - didn't even notice this site had an expired license so it didn't go to the latest version when we ran the upgrade, so the difference makes sense now at least. Have already patched it so should be good to go. Thanks