Senior2323

Similar issue here. 2000 pages of failed (blocked) card transactions.

yeah we need a pending cleanup, like a task to delete pending invoices after X days, or captcha on the invoice generation page.

My issue is a little more sinister. The site was being used for 'card testing' by fraudsters. They were firing thousands of £1 payments from different credit card numbers through the Stripe integration (about 10 per second) using the Donation Goals system.
This killed the site completely and I had to mitigate via the host's CP, blocking the offending IPs being used by the bots.
They were doing this in order to discover which of the cards weren't blocked. Of the 48,000 odd transactions, only 31 were accepted but I still have 48,000 blocked transactions in my log.
I have been advised by Stripe to refund the 31 good transactions to prevent any disputes, but that means I'm still out-of-pocket for the fees. Thank goodness most of them didn't get through.
IMHO we desperately need something adding in as friction to prevent this. Either captcha or the means to exclude Guests from accessing the Donation Goals block and subsequent form fields.
Even the ability to exclude Cards as a payment option for Donation Goals and any other public facing products/services would be a step forward.

Oh my god, that may have been what was happening to me!!!!!
The same day, I had like 41 guests that did $1 charges. I just figured I got mentioned somewhere, never put them together!

Good news.
This issue is being addressed in the next update (4.7.2). It will no longer be possible for non-members to Donate.

Should be donate or buy, what if you have a cheap $5 product, and they just hammer that all day long

Hi. You can use the following query:
DELETE FROM `nexus_invoices` WHERE `nexus_invoices`.`i_status` = 'expd' or 'canc'; ref: delete expired or canceled Invoices | Invision Community

You could probably prevent this for purchases using Payments > Settings > Anti Fraud Rules.
Maybe set the value for the lower priced items and then a rule that rejects after one blocked payment. Another option would be to block payments from Guests altogether.

Donations work different to purchases in IPS, which was the reason why it was so easy to abuse the system as guest, hence our change to allow it only for members 

It seems to me that the biggest problem is that donations cannot be set only for logged in users and do not have any CAPTCHA security.
Through site.com/clients/donations/ you can create thousands of pending invoices as guest.
  Edit:
very good decision 👍

That's bad actually - why would you want to force donors to register. Then deal with forum account deletion request... 
Just don't save any pending invoice/transaction for guest. If transaction is not completed, it's not completed. 
 

I am just going to have another button for Paypal for guest donations.

That's a problem right? To fix one problem, now you need to add another guest donation button.... 
 

It’s a quick “fix”, but a proper guest checkout should come anyway to comply with EU regulations. 
https://invisioncommunity.com/forums/topic/467795-commerce-app-requirement-for-guest-checkout/
 

Somewhat, I mean if I want people to be able to donate crypto, I have to have something for that anyhow. So might as well give an option for account-less donations.

I saw a note in release notes. Can you please re-evaluate this fix? I don't want to FORCE users, just to donate on our site. 
I also host my site in Europe but I am from US and not fully aware of EU regulations .. but what opentype is saying is true, I will have another issue to deal with. Please review your changes. - Thanks
 

The best option would be to select a group that would have access to the page

4.5, 4.6 and 4.7 
 
Whenever you submit a reply to any recent status update the saving button keep showing "Saving......" since IPS updated to 4.5, and the bug still shows on 4.6 and 4.7. 

Then if you refresh the page, you will notice that reply is already posted. 

After moving the JS to the "header" tag, the status seems to work fine (at least for me on 4.7.1). Weird.

The stats for ranks (only them) are not working for me. I have ranks and badges running. The latest version of the forum. PHP 7.4. What can I do about this?

I notice there are a few plugins running there. Please disable all plugins and applications that are 3rd party, and then try again

@Marc Stridgen I disabled the plugins shown at the bottom of the previous screenshot. Error looks similar (just without info about plugins):
 

Taking a look at our release notes and checking on my instance, it looks like there have been issues resolved on this area in the next upcoming release, which is currently in beta

For example in the message I give them a direct link to their own profile page so that they can quickly upload a profile pic. In my canned answer I've written PROFILE_PAGE and every time I send a message I have a to manually copy and paste/replace PROFILE_PAGE with their actual profile page URL, I wish this could be handled automatically. 

Too bad, thanks for your trouble. Maybe you will find the solution.
Thanks for the help.