iyzico Payments (3DS, Installments, Marketplace)

Added 3

• License check. Enter your license key (or CS-Cart Marketplace license number) on the new License tab of the settings. The add-on verifies it with cs-cart.kaviolabs.com when the key is saved and then once a day, only from the admin panel or cron, never on storefront requests. The license covers the domain entered at purchase and all its subdomains; local development hosts are always allowed.
• License card at the top of the add-on page (status in color, licensed domain, result per storefront, last and next check, end of the updates period, what switches off) with Check now, a license badge in Add-ons → Manage add-ons, a status bar on the add-on's own admin pages, and a cron entry point.
• Without a valid license for the store's domain, the iyzico payment methods are no longer offered at checkout and the admin panel shows a notice. Payments that have already started still complete, and callbacks, webhooks, refunds, cancels and marketplace approvals and payouts of existing orders keep working. New installations and upgrades from 1.0.x work for 14 days before a key is required, and if the license server cannot be reached the add-on keeps working for 14 days.

Fixed 1

• Singular and plural forms ("1 item approved", "1 vendor payout detail change waits for approval") instead of "item(s)" and "change(s)" in admin notices (new language variables, so in-place upgrades add them).

Tested on Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2. No breaking changes.

Changed 1

• Compatible with CS-Cart and Multi-Vendor 4.21 and PHP 8.3: tested on Multi-Vendor 4.21.2 with PHP 8.3 and the new Nova theme. The add-on now declares the supported range 4.17.2 – 4.21.x.

Tested on Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2. No breaking changes.

Added 2

• In-place upgrades now complete themselves. After the add-on files are replaced (uploading the new zip over the installed add-on in Add-ons → Manage add-ons, copying the files by FTP, or installing an Upgrade Center package), the next admin page view adds any missing tables, columns, settings, language variables and e-mail templates, and updates the stored add-on version and icon flag. Existing data and setting values are kept. A hidden schema_version setting records the last applied version.
• Stores upgraded in place from 1.0.0 or 1.0.1 now get the payout change requests table and the "Require admin approval for vendor payout detail changes" setting (default "Yes, always") without a reinstall.

Fixed 2

• While the add-on was disabled, saving or refreshing its settings, or uploading a new version over it, stopped with a "Class not found" error. That could leave the settings only partly rebuilt. CS-Cart loads the add-on functions for a disabled add-on without its classes; the add-on now registers them itself.
• After an upgrade by uploading the new zip over the installed add-on, CS-Cart saved empty multiple-choice settings with an empty selected entry. The next admin page view now repairs them.

Tested on Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2. No breaking changes.

Fixed 1

• The add-on icon was not shown in the admin panel: addon.xml now declares has_icon.

Tested on Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2. No breaking changes.

Added 1

• Admin approval for vendor payout detail changes. A new Marketplace setting, "Require admin approval for vendor payout detail changes", defaults to "Yes, always". The other choices are "Only when Vendor data premoderation checks vendor profile changes" and "No". When a vendor changes the IBAN, business type, identity number, tax office, tax number, legal company title, contact name or mobile number on the iyzico sub-merchant tab, the change is stored as a pending change in the add-on's own table. The vendor's first registration is included. The live details and the iyzico sub-merchant stay unchanged until an administrator approves the change, and the vendor status is never touched.

Security 1

• 1.0.1 stopped iyzico sub-merchant data from counting as a vendor profile change under Vendor data premoderation. As a side effect, a vendor could change the payout IBAN without any approval, and the change was sent to iyzico immediately. A taken-over vendor account could have redirected payouts. From 1.0.2, such changes need admin approval by default. The vendor status still never changes because of this data.

Tested on Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2. No breaking changes.

Fixed 2

• Guest checkout could end on the login form instead of the order confirmation after a successful payment. The guest's access to the order was only written to the session at checkout, and a checkout request of the same visitor still running (e.g. an address update fired while typing) could overwrite it. The payment page link now carries a key bound to the visitor's session (HMAC with the method's secret key, never sent to iyzico) that restores the access, and the iyzico callback restores it for the session that started the payment. The payment page now opens only for the visitor who placed the order (the logged-in owner, the guest's session or the session-bound key); the key is useless in another session and never opens another order.
• Multi-Vendor with vendor data premoderation: saving the iyzico sub-merchant data (IBAN, identity and tax data) on the vendor profile could send the vendor to "Pending" and hide their storefront. This data is kept in the add-on's own table and no longer counts as a vendor profile change, so the vendor status never changes because of it, whether the vendor or the administrator saves it.

Added 1

• Add-on icon in the admin add-on list.

Removed 1

• Unused language files from the package.

Tested on Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2. No breaking changes.

Added 17

• "iyzico" payment processor built on the iyzico REST API with IYZWSv2 request signing; TLS peer verification stays on.
• Checkout Form with 3D Secure (forceThreeDS), shown embedded (responsive), as a popup, in an iframe or as a redirect to the iyzico page.
• Pay with iyzico (iyzico wallet) as a second integration mode.
• Installments: allowed installment counts per payment method, and a checkout table of monthly and total amounts per card family from the iyzico installment API, cached per cart total.
• Optional transfer of installment interest to the order total as a payment surcharge.
• TRY, USD, EUR and GBP, charged in the store's primary currency or the customer's selected currency. The method is hidden when no supported currency is available.
• Exact basket mapping: products, shipping per vendor, gift certificates and the payment surcharge. Discounts, gift certificates, reward points, taxes added on top and currency rounding are split with the largest remainder method, so the item prices always add up to the charged amount.
• Buyer and address mapping, with the identity number (TCKN) taken from a profile field or a default value (11111111111), and phone numbers normalized to +90….
• Server-side result retrieval with response signature, basket, currency and amount checks. Idempotent completion shared by the callback, the webhook and the admin status check.
• Webhook endpoint with X-Iyz-Signature-V3 verification.
• Admin "iyzico" order tab with the payment summary, basket item transactions, full and partial refunds (split per item), same-day cancel, payment status check and refund history.
• Configurable order statuses for paid, fraud review, failed, fully refunded and cancelled payments.
• Multi-Vendor iyzico Marketplace mode:
• Masked logging under the "iyzico" log type (Settings → Logging), with optional full request and response logging.
• Separate sandbox and live keys and a "Test connection" button.
• English texts.
• Unit tests, an iyzico API mock server and headless-browser end-to-end tests.

Tested on Multi-Vendor 4.17.2, CS-Cart 4.17.2, Multi-Vendor 4.21.2. First release.