Skip to content

UR-4825 Fix - Live Stripe key validated even when Test Mode is enabled - #1393

Open
saurab018 wants to merge 2 commits into
developfrom
UR-4825-live-stripe-key-is-validated-even-when-test-mode-is-enabled
Open

UR-4825 Fix - Live Stripe key validated even when Test Mode is enabled#1393
saurab018 wants to merge 2 commits into
developfrom
UR-4825-live-stripe-key-is-validated-even-when-test-mode-is-enabled

Conversation

@saurab018

@saurab018 saurab018 commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

All Submissions:

Changes proposed in this Pull Request:

https://themegrill.atlassian.net/browse/UR-4825

Stripe settings could not be saved when Test Mode was enabled if the (hidden) Live Publishable Key field held anything that did not start with pk_live_. Saving failed with:

Invalid Stripe live publishable key. It must start with pk_live_.

Root cause: the client-side pre-check in the payment section Save handler (assets/js/admin/settings.js) validated both the test and the live publishable key on every save, without looking at the Test Mode toggle. Because the Live fields are hidden while Test Mode is on, the request was aborted before the AJAX call and the user had no visible field to correct.

The server-side validation in modules/stripe/class-ur-stripe-module.php was already mode-aware — it derives the mode from user_registration_stripe_test_mode and only checks that mode's key prefix — so only the JS guard needed fixing.

Fix: the JS guard now mirrors the PHP logic: it reads the Test Mode toggle from the collected section data, picks the publishable key of the active mode only, and checks just that prefix (pk_test_ for test, pk_live_ for live). Falls back to test mode when the toggle is absent, matching the PHP default. Keys for the inactive mode are no longer validated.

Changed files: assets/js/admin/settings.js and its minified build assets/js/admin/settings.min.js.

How to test the changes in this Pull Request:

  1. Go to User Registration & Membership → Settings → Payments → Stripe and enable Stripe.
  2. Enter a test Publishable Key (pk_test_...) and test Secret Key into the Live Key fields.
  3. Enable Enable Test Mode (Live fields become hidden), fill valid test keys in the Test Key fields, and click Save.
    • Before: save is blocked with "Invalid Stripe live publishable key. It must start with pk_live_." — and the offending field is hidden, so it cannot be corrected.
    • After: the live key is ignored while Test Mode is on and the settings save normally.
  4. Regression — test mode validation still works: with Test Mode enabled, put a pk_live_... (or any non-pk_test_) value in Test Publishable Key and save. Expect "Invalid Stripe test publishable key. It must start with pk_test_."
  5. Regression — live mode validation still works: disable Test Mode, put a non-pk_live_ value in Live Publishable Key and save. Expect "Invalid Stripe live publishable key. It must start with pk_live_."
  6. Confirm a fully valid configuration still saves and the connection status updates in both modes.

Types of changes:

  • Bug fix (non-breaking change which fixes an issue)
  • Enhancement (modification of the currently available functionality)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Other information:

  • Have you added an explanation of what your changes do and why you'd like us to include them?
  • Have you successfully ran tests with your changes locally? (JS syntax-checked; the UI steps above still need a manual pass)
  • Have you updated the documentation accordingly?

Changelog entry

Fix - Stripe settings could not be saved when Test Mode was enabled because the Live publishable key was still being validated.

@saurab018 saurab018 self-assigned this Aug 13, 2026
@lihsaa591

Copy link
Copy Markdown
Contributor

@tg-autopilot review

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a client-side validation bug in the Stripe payment settings save handler so that only the publishable key for the currently active mode (Test vs Live) is validated, preventing saves from being blocked by hidden/inactive fields.

Changes:

  • Update Stripe publishable-key prefix validation in assets/js/admin/settings.js to validate only the active mode’s key based on the Test Mode toggle.
  • Regenerate the corresponding minified build in assets/js/admin/settings.min.js.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File Description
assets/js/admin/settings.js Adjusts Stripe save-time publishable-key validation to be mode-aware.
assets/js/admin/settings.min.js Minified build reflecting the updated Stripe validation logic.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread assets/js/admin/settings.js Outdated
Comment on lines +1746 to +1759
var testModeValue = section_data["user_registration_stripe_test_mode"];
var isTestMode =
"undefined" === typeof testModeValue
? true
: !(
false === testModeValue ||
"false" === testModeValue ||
"0" === testModeValue ||
"" === testModeValue
);
var pubKey =
( isTestMode
? section_data["user_registration_stripe_test_publishable_key"]
: section_data["user_registration_stripe_live_publishable_key"] ) || "";

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fair point — that value is always a real boolean from $item.is(":checked"), so the string-form checks were dead code. Simplified to Boolean( section_data["user_registration_stripe_test_mode"] ) , re-minified settings.min.js with the project's own grunt terser:admin task (confirmed all 20 other admin JS files re-minify byte-identical, so this is the correct build output) — pushed in 0f688c9.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants