https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41197 --- Comment #2 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- (In reply to David Cook from comment #1)

Can you run us through how this should work?

I see a reference to opac-account-pay-return.pl in "opac_online_payment_begin.tt" in dev-koha-plugin-kitchen-sink, but it looks like it is an update so it should have a CSRF token (although it's missing in the plugin version I'm looking at).

So the general process is: 1 -opac payment begin - We select the charges to pay - the user/charges are then sent to the vendor site for processing payment 2 -the vendor should then POST to the API to make the actual payment and verify things on their end 3 - opac payment end - the payment vendor redirects the patron back to the Koha catalog, they may send some information about the payment, but the actual changes have been handled in step 2, step 3 is just reporting -- You are receiving this mail because: You are watching all bug changes.