Having trouble with unanticipated Credit Card payment method showing in client portal when adding new payment method

[TBroMEM]

We added a custom payment gateway module some years ago, but I just noticed something (and it has apparently been this way since inception).

We have two gateways, one for CC and one for ACH. We also have option enabled for Mail-in Payment in some instances (we have more than one). In some cases, there are other gateways listed in our config, but they are all listed as 'Do Not Use'.

In some cases, when adding a payment method (e.g. /index.php?rp=/account/paymentmethods/add), it shows up as follows:

'Credit Card (A)'    'Credit Card'    'Bank Account'

Credit Card (A) is our custom gateway module, Bank Account is tied to our ACH gateway, but I have no clue what Credit Card is for. When utilized, there is the typical form to submit card info, and it submits into the WHMCS instance, but it is not associated with our custom CC option, which calls out to a gateway api with info to get and store token.

Interestingly enough, in another instance, which happens to ONLY have our custom gateway modules enabled, it only shows as:

'Credit Card (A)'   'Bank Account'

I am trying to understand how this would even happen.

I had inspected the element and found the options referenced under inputPaymentMethodType, showing the three (Credit Card (A), Credit Card, Bank Account), and found it referenced in account-paymentmethods-manage.tpl for the related theme template. I noted some logic related to $enabledTypes (tokenGateways, LocalCreditCard, and bankAccount). I can associate Credit Card (A) to tokenGateways, and our ACH/Echeck gateway to bankAccount, but not sure where the website would determine we have a localCreditCard enabled. How is that even determined?

            <div class="form-group row">
                <label for="inputPaymentMethodType" class="col-md-4 control-label">{lang key='paymentMethods.type'}</label>
                <div class="col-md-8">
                    {if $enabledTypes['tokenGateways']}
                        {foreach $tokenGateways as $tokenGateway}
                            <label class="form-check form-check-inline">
                                <input type="radio" class="icheck-button" name="type" value="token_{$tokenGateway}" data-tokenised="true" data-gateway="{$tokenGateway}"{if $editMode && $payMethod->isCreditCard() && $payMethod->gateway_name == $tokenGateway} checked{/if}{if $editMode} disabled{/if}>
                                {$gatewayDisplayNames[$tokenGateway]}
                            </label>
                        {/foreach}
                    {/if}
                    {if $enabledTypes['localCreditCard']}
                        <label class="form-check form-check-inline">
                            <input type="radio" class="icheck-button" name="type" value="localcard"{if ($editMode && $payMethod->isCreditCard() && !$payMethod->isTokenised()) || (!$editMode && $paymentMethodType != 'bankacct')} checked{/if}{if $editMode} disabled{/if}>
                            {lang key='paymentMethodsManage.creditCard'}
                        </label>
                    {/if}
                    {if $enabledTypes['bankAccount']}
                        <label class="form-check form-check-inline">
                            <input type="radio" class="icheck-button" name="type" value="bankacct"{if ($editMode && !$payMethod->isCreditCard()) || ($paymentMethodType == 'bankacct')} checked{/if}{if $editMode} disabled{/if}>
                            {lang key='paymentMethodsManage.bankAccount'}
                        </label>
                    {/if}
                </div>
            </div>

Does anyone have any insights in regards to the section related to localCreditCard? The big question is how can it work in one instance and not in another. I compared the two instances and they have the same noted code.

[TBroMEM]

I did a postman POST to the WHMCS api using GetPayMethods action and the item in question shows without any gateway. It is a ghost card.

{
    "result": "success",
    "clientid": "12345",
    "paymethods": [
        {
            "id": 1234,
            "type": "CreditCard",
            "description": "Test using Credit Card option",
            "gateway_name": "",
            "contact_type": "Contact",
            "contact_id": 1234,
            "card_last_four": "XXXX",
            "expiry_date": "XXXX",
            "start_date": "",
            "issue_number": "",
            "card_type": "Visa",
            "remote_token": "",
            "last_updated": "02/17/2025 17:44"
        }
}

The other samples show type as RemoteCreditCard with an assigned token.

How in the world is the Credit Card option showing up when adding pay method when there is only two active token based (CC and ACH) gateway choices configured?

 

 

 

[TBroMEM]

Does anyone have any insights on how the client portal is determining $enabledTypes?

The odd thing I am dealing with is that with one of the instances that has the same custom gateway(s) configured, it is only showing to two options anticipated. When I disable out two custom gateway modules (deselect display on order form), the invalid Credit Card option disappears from the other.

All I I can seem to surmise is that we somehow miscoded something in our gateway module that trips up the logic with account-paymentmethods-manage.tpl.

To resolve, given we do NOT have any other gateway modules in place, I could safely remark out the following section (which I will be testing).

                    {if $enabledTypes['localCreditCard']}
                        <label class="form-check form-check-inline">
                            <input type="radio" class="icheck-button" name="type" value="localcard"{if ($editMode && $payMethod->isCreditCard() && !$payMethod->isTokenised()) || (!$editMode && $paymentMethodType != 'bankacct')} checked{/if}{if $editMode} disabled{/if}>
                            {lang key='paymentMethodsManage.creditCard'}
                        </label>
                    {/if}

[TBroMEM]

I reviewed the sample gateway module on Github (https://github.com/WHMCS/sample-gateway-module/blob/master/modules/gateways/gatewaymodule.php)

I noticed some variables that are NOT listed in the documentation for metadata params (https://developers.whmcs.com/payment-gateways/meta-data-params/).

DisableLocalCreditCardInput
TokeniszedStorage

function gatewaymodule_MetaData()
{
    return array(
        'DisplayName' => 'Sample Payment Gateway Module',
        'APIVersion' => '1.1', // Use API Version 1.1
        'DisableLocalCreditCardInput' => true,
        'TokenisedStorage' => false,
    );
}

Although the settings defined don't seem to coalesce, I would assume that the following would indicate (to the related portal template for payment methods) that it is a Tokenized Credit Card option, and the Local Card option would be disabled.

'DisableLocalCreditCardInput' => true,
'TokenisedStorage' => true,
 

Am I viewing this correctly?

Edited Tuesday at 04:46 PM by TBroMEM
better clarity in last pararagh

[TBroMEM]

Given we do NOT have any localcreditcard type gateways available in our instances, I was able to resolve by remarking out the localCreditCard section in the account-paymentmethods-manage.tpl, which I deployed with a new custom child theme. Now, when adding a new payment method, only Credit Card (A) and Bank Account are listed. Conceivably this may have surfaced due to issues in our gateway module, but navigating through that change is a much bigger pill to swallow.