2 Support questions or comments

• 
  1 week ago
  rickincabo

  Looks like a nice script. Too bad it's not what i am looking for, but comes pretty close.
  
  I need a simple affiliate script, that would track sales on certain pages instead of opened links, with some tracking javascript code. Instead of getting commissions for opened links, the user would get a fixed or variable commission (To be set admin side) on each sale.
  
  Most of the pages would be the same as here, except for the links section / would track sales instead, and a tab in the settings where the user would get his personal affiliate link for a particular domain. On the admin side, the admin would be able to set up multiple domains and automatically get the corresponding tracking script to be added to pages.
  
  This tracking script would then pickup used affiliate links, calculate commissions and display the sales in the user's dashboard.
• View 8 more replies
• 
  1 week ago
  NextMAS Author

  Thanks for reaching out.
  1. Config file is added in the installer (Make sure to have permission to write files in the root directory).
  2. About the Script you require. I believe you are saying that,
  - You can create a affiliate javascript code and embed on a page. It will keep track of purchases made on that particular page and later on decides the commission.
  
  Admin Generate Script (JavaScript) -> Paste it on page -> Tracks for user (using cookies) -> Provide commission based on sales?
  
  Am I right? Please correct me if I am wrong.
• 
  1 week ago
  rickincabo

  That's it.
  
  The same script as this one, only instead of links/opens page, there would be on eachline an id, the domain where the commission was generated. name of the product, price of the product and the sales commission in $ (set up admin side)
  
  On the admin side, add a table products, a table commissions (id, user_id, domain, product url, sales commission) and a field in the admin panel to set the general commision rate for all. You could also do it per user then you'll have to add a field in the user's table to hold the rate which can be then changer per user in the user's list.
  
  I need such a script so bad.
• 
  1 week ago
  NextMAS Author

  I get it. I can work on it, It will take 1-2 weeks. Is it fine with you?
  Also if possible, share me details of all the things you require.
• 
  1 week ago
  rickincabo

  It would be AMAZING. The only tricky part would be the little piece of javascript to track sales on payment success pages, and the creation of correct parameters for the affiliate links so they get picked up correctly by the javascript.
  
  Maybe something like this:
  
  <script type="text/javascript">
  var amnt = document.querySelector('[name="amount"]'.value;
  var product_id = document.querySelector('[name="product-id"]'.value;
  var x = new XMLHttpRequest();
  x.open("GET","https://www.domainwherescriptisinstalled.com/conversions.php?amt="+amt+"&id="+id,true);
  x.withCredentials = true
  x.send();
  </script>
  
  conversions.php could look like this:
  
  <?php
  include "db.php";
  include "functions.php";
  $idb = $dbserver;
  if (empty($idb))
  {
  header("Location:installer.php";
  }
  $link = mysqli_connect($dbserver, $dbusername, $dbpassword, $dbdatabase);
  $refer = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '';
  $refer = get_domain($refer);
  
  //start session and define the required variables
  ini_set('session.cookie_lifetime', $sessdur);
  
  session_start();
  
  $sql1 = "SELECT * FROM domains WHERE DOMAIN = '" . $refer . "' ";
  $result = mysqli_query($link, $sql1);
  if (mysqli_num_rows($result) > 0)
  {
  header('Access-Control-Allow-Origin: ' . $_SERVER['HTTP_ORIGIN']);
  header('Access-Control-Allow-Credentials: true';
  header('Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS';
  header('Access-Control-Max-Age: 1000';
  header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With';
  header('Set-Cookie: cross-site-cookie=name; SameSite=None; Secure';
  
  //check if the referer domain is valid and the user was actually refered by an affiliate
  if (!empty($_GET['amt']))
  {
  $_SESSION['amt'] = $_GET['amt'];
  $_SESSION['tid'] = $_GET['id'];
  }
  }
  ?>
  </div>
  </div>
  </body>
  </html>
  <?php ob_end_flush(); ?>
  
  These functions could be useful:
  
  // Get domain from url
  function get_domain($url)
  {
  $pieces = parse_url($url);
  $domain = isset($pieces['host']) ? $pieces['host'] : $pieces['path'];
  if (preg_match('/(?P<domain>[a-z0-9][a-z0-9-]{1,63}.[a-z.]{2,6})$/i', $domain, $regs)) {
  return $regs['domain'];
  }
  return false;
  }
  
  // Get page title
  function getTitle($url) {
  $data = file_get_contents($url);
  $title = preg_match('/<title[^>]*>(.*?)</title>/ims', $data, $matches) ? $matches[1] : null;
  return $title;
  }
  
  And then you would also have to create a referer's table, to make sure transactions are legitimate and the commissions are legit. Not easy. But if you want to give it a try, i'm here.
• 
  1 week ago
  NextMAS Author

  Thanks for sharing. I will start working on it soon and will keep you updated.
• 
  1 week ago
  rickincabo

  Great, i will look in as often as i can. Good luck!
• 
  1 week ago
  NextMAS Author

  It will be more secure if you tell me which payment gateway is used, so I can verify the Transaction ID and it will have the accurate commission calculated.
• 
  1 week ago
  NextMAS Author

  Hi. I was trying to build a flowchart and I am facing issue with this ""to make sure transactions are legitimate and the commissions are legit" this requirement requires checking the transaction ID in the payment gateway, without that it won't be able to verify the transaction. Because a person can just keep refreshing the page once payment succeed and it will counted as commission until and unless we store the transaction_id or similar in the database.
• 
  1 week ago
  rickincabo

  Hi too. Sorry for my abscence. Let's go for PayPal and stripe.
  
  The problem with the refreshing can be easily solved. To guarantee that each PayPal or Stripe payment only generates one commission—and that it’s genuinely settled on the gateway side—you want to shift the moment of “processing” off the user’s browser and into your server, use the gateway’s server-to-server notification (IPN / Webhook), and record every transaction’s unique ID before you ever write out a commission. Here’s the high-level flow:
  
  A[Customer clicks “Pay”] --> B[Redirect to PayPal/Stripe]
  B --> C [Customer completes payment]
  C --> D [Gateway sends Webhook/IPN to your server]
  D --> E [Your server: Validate payload & signature]
  E --> F {Is transaction_id already in DB?}
  F -- No --> G [Insert transaction_id; calculate & store commission]
  F -- Yes --> H [Ignore; already processed]
  G --> I [Respond 200 OK to gateway]
  H --> I
  I --> J [Optionally email/notify admin/user]
  
  Key implementation steps
  1. Use Webhooks/IPN rather than trusting page‐refresh
  PayPal: configure an IPN listener URL and, upon receipt, validate the IPN message via PayPal’s API before trusting it.
  Stripe: configure a webhook endpoint; verify the signature header (Stripe-Signature) with your webhook secret.
  
  2. Persist every transaction ID
  Create a table, e.g. processed_payments
  CREATE TABLE processed_payments (
  id BIGINT AUTO_INCREMENT PRIMARY KEY,
  gateway ENUM('paypal','stripe' NOT NULL,
  transaction_id VARCHAR(255) NOT NULL,
  amount DECIMAL(10,2),
  currency CHAR(3),
  affiliate_id INT NOT NULL,
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
  UNIQUE KEY uq_gateway_txn (gateway, transaction_id)
  );
  The UNIQUE KEY enforces at most one row per gateway+transaction.
  
  3. And then process it:
  
  <?php
  // Example for the Webhook/IPN handler:
  // 1. Parse & validate the payload:
  $payload = @file_get_contents('php://input';
  $isValid = verifyWithGateway($payload, $_SERVER['HTTP_STRIPE_SIGNATURE'] ?? null);
  if (! $isValid) {
  http_response_code(400);
  exit('Invalid signature';
  }
  $data = json_decode($payload, true);
  $txId = $data['id']; // Stripe: “evt.data.object.charges.data[0].id”; PayPal: “txn_id”
  $gateway = 'stripe'; // or 'paypal'
  $affiliate = lookupAffiliate($data['metadata']['affiliate_code']);
  // 2. Attempt to record the transaction:
  $db = new PDO(...);
  $stmt = $db->prepare("
  INSERT IGNORE INTO processed_payments
  (gateway, transaction_id, amount, currency, affiliate_id)
  VALUES
  (:gw, :tx, :amt, :cur, :aff)
  ";
  $stmt->execute([
  ':gw' => $gateway,
  ':tx' => $txId,
  ':amt' => $data['amount'] / 100, // Stripe uses cents
  ':cur' => strtoupper($data['currency']),
  ':aff' => $affiliate->id,
  ]);
  if ($stmt->rowCount() > 0) {
  // Row was inserted => commission hasn't been paid yet.
  payCommission($affiliate, $data['amount'] / 100);
  }
  // else: duplicate, so we do nothing.
  // 3. Acknowledge to gateway
  http_response_code(200);
  echo 'OK';
  ?>
  
  4. The INSERT IGNORE (or equivalent “upsert”) plus checking rowCount() makes the logic idempotent: only the first webhook inserts and triggers payCommission().
  
  5. Keep your redirect page “dumb”
  Your “thank you” page should not calculate commissions; it simply shows a receipt. All actual processing happens in step 2, safe from user refresh tricks.
  
  ALL IN ALL
  
  + Server‐to‐server validation means you can’t fake a payment by refreshing or spoofing parameters.
  + Unique index guarantees one‐time processing.
  + Code handles duplicate webhooks gracefully (PayPal/IPN may retry).
  
  With this pattern, once a transaction has been recorded in your processed_payments table, no amount of page-refreshing or re-submitting will create extra commissions.
• 
  1 week ago
  NextMAS Author

  Absolutely. Thanks.
• 
  1 week ago
  rickincabo

  No problem. Feel free to ask.

• 
  4 weeks ago
  siteco Purchased

  Hi. config.php file missing for install. -- Warning: require_once(config.php): Failed to open stream: No such file or directory. Thanks
• View 3 more replies
• 
  4 weeks ago
  NextMAS Author

  Did you install it properly as specified in the instructions file?
  Also, are you installing it in the root directory?
  
• 
  4 weeks ago
  siteco Purchased

  Yes I install it on Sub.domain - https://on.ugo2.ca/
• 
  4 weeks ago
  NextMAS Author

  Can you retry installing it?
  If issue persists, I will provide you manual config file.
• 
  4 weeks ago
  siteco Purchased

  I did it for a 4th time and still the same warning. Thank you
• 
  4 weeks ago
  NextMAS Author

  Okay. Can you check personal message on codester.
  I have shared you the config file.
• 
  1 week ago
  rickincabo

  Is the config file now in the final package?