| @@ -132,9 +132,13 @@ | ||
| 132 | 132 | data: { |
| 133 | 133 | action: 'easy_invoice_process_payment', |
| 134 | 134 | invoice_id: invoiceId, |
| 135 | 135 | payment_method: 'stripe', |
| 136 | - payment_nonce: easy_invoice_vars.nonce | |
| 136 | + payment_nonce: easy_invoice_vars.nonce, | |
| 137 | + // Per-invoice access token from the emailed link (?ik=...). | |
| 138 | + // The server authorises the payment on it — see | |
| 139 | + // InvoiceController::canSubmitPaymentForInvoice(). | |
| 140 | + access_token: easy_invoice_vars.access_token || '' | |
| 137 | 141 | }, |
| 138 | 142 | success: (response) => { |
| 139 | 143 | if (response.success && response.data.client_secret) { |
| 140 | 144 | this.stripeClientSecret = response.data.client_secret; |
| @@ -299,9 +303,10 @@ | ||
| 299 | 303 | data: { |
| 300 | 304 | action: 'easy_invoice_process_payment', |
| 301 | 305 | invoice_id: invoiceId, |
| 302 | 306 | payment_method: this.selectedGateway, |
| 303 | - payment_nonce: easy_invoice_vars.nonce | |
| 307 | + payment_nonce: easy_invoice_vars.nonce, | |
| 308 | + access_token: easy_invoice_vars.access_token || '' | |
| 304 | 309 | }, |
| 305 | 310 | success: (response) => { |
| 306 | 311 | if (response.success) { |
| 307 | 312 | this.handlePaymentSuccess(response.data); |
