Leaderboard

I have a coupon I made for a friend which was for 50% off. I set him up as a client and created the service, applying the discount code. The service normally costs $29.99, and Blesta calculated 50% to $15. However, when the friend went to pay, the following errors came about: https://api.stripe.com/v1/charges a:1:{s:5:"error";a:3:{s:4:"type";s:21:"invalid_request_error";s:7:"message";s:23:"Invalid integer: 1499.5";s:5:"param";s:6:"amount";}}I'm sort of glad it failed and didn't hit his bank for nearly $1500! Oddly, when he tried again, it worked! (It charged him $15 correctly, but not going to post the successful log since it contains personal information) Here is the mail Blesta sent him regarding the failed transaction:

Just a quick announcement to any Blesta customers who also have WHMCS installs. You should take them down immediately until a patch is released. Please see http://www.webhostingtalk.com/showthread.php?t=1309491 I'm not going to post a link to the POC, however you should know that it is a CRITICAL vulnerability.

CORE-795 is fixed for 3.0.4. To patch yourself update /components/email/email.php lines 260-276: from: $body_text = null; foreach ($this->message->getChildren() as $child) { if ($child->getContentType() == "text/plain") $body_text = $child->getBody(); } $vars = array_merge($vars, array( 'to_address'=>implode(',', array_keys((array)$this->message->getTo())), 'from_address'=>implode(',', array_keys((array)$this->message->getFrom())), 'from_name'=>implode(',', array_values((array)$this->message->getFrom())), 'cc_address'=>$cc_address, 'subject'=>$this->message->getSubject(), 'body_text'=>($body_text), 'body_html'=>($this->message->getContentType() != 'text/plain' ? $this->message->getBody() : null) ) ); to: $body_text = null; $body_html = null; foreach ($this->message->getChildren() as $child) { if ($child->getContentType() == "text/plain") $body_text = $child->getBody(); } if ($body_text === null) $body_text = $this->message->getBody(); else $body_html = $this->message->getBody(); $vars = array_merge($vars, array( 'to_address'=>implode(',', array_keys((array)$this->message->getTo())), 'from_address'=>implode(',', array_keys((array)$this->message->getFrom())), 'from_name'=>implode(',', array_values((array)$this->message->getFrom())), 'cc_address'=>$cc_address, 'subject'=>$this->message->getSubject(), 'body_text'=>$body_text, 'body_html'=>$body_html ) );

I can't imagine identical behavior concluding in different results in this instance, but to me, this looks like a rounding issue in Stripe (or lack thereof) since only integers should be sent. By the way, Stripe expects the amount in cents, so 1499.5 = $14.995

I was just able to duplicate. Created CORE-795. When HTML emails are disabled, the email component is not able to find the plain-text version of the email content for logging.

I always like being able to choose the number of things to display. I hate pagination and would rather scroll. If I wanted to flip pages, I'll just get a book! LOL