| @@ -210,8 +210,12 @@ | ||
| 210 | 210 | formData.append('payment_type', paymentType); |
| 211 | 211 | formData.append('payment_notes', paymentNotes); |
| 212 | 212 | formData.append('payment_proof', paymentProof); |
| 213 | 213 | formData.append('nonce', easy_invoice_ajax.nonce); |
| 214 | + // Per-invoice access token forwarded from the URL (?ik=...). | |
| 215 | + // The server-side canSubmitPaymentForInvoice() gate accepts this | |
| 216 | + // as proof that the visitor came from a legitimate emailed link. | |
| 217 | + formData.append('access_token', easy_invoice_ajax.access_token || ''); | |
| 214 | 218 | |
| 215 | 219 | // Show loading |
| 216 | 220 | $(this).prop('disabled', true).text('Processing...'); |
| 217 | 221 | |
