From e480c8c329040b2828df162a02581ff3d70095bc Mon Sep 17 00:00:00 2001
From: Jules Nsenda <jules@paystack.com>
Date: Wed, 28 Oct 2026 09:42:05 +0200
Subject: [PATCH 1/2] fix: stop a failed usage-tracker call from fataling the
 thank-you page

The plugin tracker host returns a non-JSON Cloudflare error, so send_request()
threw and the uncaught exception replaced the confirmation page after every
successful payment. Tracker failures are now logged and ignored, and
send_request() treats any non-array JSON body as an unreadable response.
---
 class-gf-paystack-api.php | 19 ++++++++++++-------
 tests/fixtures.php        |  2 +-
 tests/test-gateway.php    | 23 +++++++++++++++++++++++
 3 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/class-gf-paystack-api.php b/class-gf-paystack-api.php
index a597a7c..42d1f1b 100644
--- a/class-gf-paystack-api.php
+++ b/class-gf-paystack-api.php
@@ -39,12 +39,17 @@ public function log_transaction_success($reference)
             'transaction_reference' => $reference
         ];
 
-        $this->send_request(
-            'log/charge_success',
-            $params,
-            'post',
-            'https://plugin-tracker.paystackintegrations.com/'
-        );
+        // Usage tracking must never block a paid customer from reaching the confirmation page.
+        try {
+            $this->send_request(
+                'log/charge_success',
+                $params,
+                'post',
+                'https://plugin-tracker.paystackintegrations.com/'
+            );
+        } catch (\Throwable $e) {
+            error_log(__METHOD__ . '(): plugin tracker request failed: ' . $e->getMessage());
+        }
     }
 
     /**
@@ -80,7 +85,7 @@ public function send_request(
 
         $body = json_decode($res['body'], true);
 
-        if ($body !== null) {
+        if (is_array($body)) {
             error_log(__METHOD__ . '(): ' . strtoupper($method) . ' ' . $uri . ' status: ' . (isset($body['status']) ? var_export($body['status'], true) : 'unknown'));
 
             if (isset($body['error']) || $body['status'] == false) {
diff --git a/tests/fixtures.php b/tests/fixtures.php
index 15fa729..7cae16e 100644
--- a/tests/fixtures.php
+++ b/tests/fixtures.php
@@ -171,7 +171,7 @@ function gf_paystack_exception_message($callback)
 {
     try {
         $callback();
-    } catch (\Exception $e) {
+    } catch (\Throwable $e) {
         return $e->getMessage();
     }
 
diff --git a/tests/test-gateway.php b/tests/test-gateway.php
index 2a19cbe..1e91272 100644
--- a/tests/test-gateway.php
+++ b/tests/test-gateway.php
@@ -118,3 +118,26 @@
 $log_api->log_transaction_success('gf-7-abc');
 $tracker_call = $GLOBALS['gf_paystack_test_remote_calls'][0];
 gf_paystack_test_check(strpos($tracker_call[0], 'plugin-tracker') !== false && !isset($tracker_call[1]['headers']['Authorization']), 'send_request headers case 1');
+
+$GLOBALS['gf_paystack_test_remote_response'] = array('response' => array('code' => 530), 'body' => 'error code: 1016');
+$tracker_thrown = gf_paystack_exception_message(function () use ($log_api) {
+    $log_api->log_transaction_success('gf-7-abc');
+});
+gf_paystack_test_check($tracker_thrown === '', 'log_transaction_success case 1: non-JSON tracker response does not throw');
+
+$GLOBALS['gf_paystack_test_remote_response'] = new WP_Error('http_request_failed', 'cURL error 6: Could not resolve host');
+$tracker_thrown = gf_paystack_exception_message(function () use ($log_api) {
+    $log_api->log_transaction_success('gf-7-abc');
+});
+gf_paystack_test_check($tracker_thrown === '', 'log_transaction_success case 2: tracker transport error does not throw');
+
+$GLOBALS['gf_paystack_test_remote_response'] = array('body' => json_encode('error'));
+$tracker_thrown = gf_paystack_exception_message(function () use ($log_api) {
+    $log_api->log_transaction_success('gf-7-abc');
+});
+gf_paystack_test_check($tracker_thrown === '', 'log_transaction_success case 3: JSON scalar tracker response does not throw');
+$scalar_thrown = gf_paystack_exception_message(function () use ($log_api) {
+    $log_api->send_request('transaction/verify/abc', array(), 'get');
+});
+gf_paystack_test_check(strpos($scalar_thrown, 'issue connecting') !== false, 'send_request case: JSON scalar response throws the generic Exception');
+$GLOBALS['gf_paystack_test_remote_response'] = array('body' => json_encode(array('status' => true)));

From b4acaaff12dde9312c4252bbd459b834c75a59ae Mon Sep 17 00:00:00 2001
From: Jules Nsenda <jules@paystack.com>
Date: Wed, 28 Oct 2026 09:42:12 +0200
Subject: [PATCH 2/2] chore: release 2.0.9

---
 paystack.php | 4 ++--
 readme.txt   | 8 +++++++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/paystack.php b/paystack.php
index 3d68d12..7f0d5ad 100644
--- a/paystack.php
+++ b/paystack.php
@@ -4,7 +4,7 @@
 Plugin URI: https://paystack.com/docs/libraries-and-plugins/plugins#wordpress
 0
 Description: Integrates Gravity Forms with Paystack, enabling customers to pay for goods and services through Gravity Forms.
-Version: 2.0.8
+Version: 2.0.9
 Author: Paystack
 Author URI: https://developers.paystack.com
 License: GPL-2.0+
@@ -31,7 +31,7 @@
 
 defined('ABSPATH') || die();
 
-define('GF_PAYSTACK_VERSION', '2.0.8');
+define('GF_PAYSTACK_VERSION', '2.0.9');
 
 require_once __DIR__ . '/includes/php-advisory.php';
 add_action('admin_notices', 'gf_paystack_php_advisory_notice');
diff --git a/readme.txt b/readme.txt
index 90347f1..fbec328 100644
--- a/readme.txt
+++ b/readme.txt
@@ -5,7 +5,7 @@ Tags: payments, subscriptions, gravityforms
 Requires at least: 5.1
 Tested up to: 7.1
 Requires PHP: 7.2
-Stable tag: 2.0.8
+Stable tag: 2.0.9
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -54,6 +54,9 @@ Yes you can! Join in on our [GitHub repository](https://github.com/PaystackHQ/pl
 
 == Changelog ==
 
+= 2.0.9 - October 28, 2026 =
+* Fixed a fatal error on the confirmation page after a successful payment when the usage tracking service is unreachable.
+
 = 2.0.8 - October 27, 2026 =
 * Security: hardened webhook and payment verification. Props k2sobot.
 * Security: API credentials and response bodies are no longer written to the PHP error log, and the API secret key is only sent to the Paystack API.
@@ -92,6 +95,9 @@ Yes you can! Join in on our [GitHub repository](https://github.com/PaystackHQ/pl
 
 == Upgrade Notice ==
 
+= 2.0.9 =
+* Fixes a fatal error customers could see after paying. Please update.
+
 = 2.0.8 =
 * Security update — please update now. After updating, rotate your live and test secret keys in the Paystack Dashboard and delete old PHP and WordPress debug log files, as earlier versions logged API request details. Ask your host to run PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later.