RKR Telegram Store (Mini App): Sell from a Telegram bot

v1.2.42026/10/19

PrestaShop Addons version: includes the module key ( module_key ), license header in all templates, and the paymentOptions hook (no payment option in the web checkout: payment is still processed within Telegram). No functional changes.

v1.2.22026/10/17

PrestaShop Addons version: the validator is cleaned in all nine sections.

Changed

• The bot's messages no longer contain HTML written in PHP: the bold text comes from a Smarty template ( tg-bold.tpl ), which also escapes the text. The client sees the same thing.
• Subscription products: RKR Product Subscription is checked to ensure it is active in the store by querying module_shop ( Module::isEnabled() is deprecated since PS 9.0).
• Code style (PrestaShop PHP CS Fixer) and types reviewed with PHPStan, no behavior changes.

Corrected

• PrestaShop 1.7.8 in debug mode: the menu "RKR Telegram Store" gave a 500 error ( array_pop() on the page title).
• Installing the module no longer leaves "Translation not found" messages in the log: texts are only translated when your catalog is loaded.

v1.2.12026/10/17

Corrected

• Subscription products (with RKR Product Subscription): These were previously purchased directly from Telegram as a one-time purchase, at the price of a single subscription fee, with no renewals, as the plan and frequency were selected only on the product page. Now, they no longer appear in the bot or Mini App cart: they display "View and subscribe on the website," which opens the product page. Any items added before the change are removed from the cart.
• The Mini App opened from the bot's menu button (without a token in the URL) used to give "invalid session": now it identifies the user by the initData signed by Telegram.
• /checkout with a missing or invalid token used to give a blank page ( Link::getIndex() does not exist): now it redirects to the homepage.
• Spanish translations of the new texts of version 1.2.0.

v1.2.02026/10/17

Safety and compatibility check before first sale.

Corrected

• Telegram native payment : the order is no longer created when you tap "Pay" (it used to be created as "Payment accepted" without payment being received). Now it's created only upon receiving successful_payment , checking chat, amount, and currency against the cart, in an idempotent manner, and saving the Telegram and vendor payment IDs.
• Fatal error when paying or going to the website in PrestaShop 9: Tools::encrypt() , Order::getOrderByCartId() and validateOrder() without PaymentModule .
• Switching to the web from Telegram no longer logs you in as the chat client: the shopping cart is simply delivered to the browser; the visitor enters or purchases as a guest.
• Link account ( /link ): only by POST with form token and showing which Telegram user the code belongs to.
• The Mini App rejected the user after pressing a button on the bot (it treated the bot as the user); the cron, "Register commands" and the Mini App page failed due to incorrect class and template names.
• Conflict with other Rekire modules: classes are passed to RkrStg* and the menu trait to RkrShopTelegramMenuTrait (with rkrsendtelegram , rkrsmartcoupons or easyblog installed the configuration gave error 500).
• Products that are deactivated, hidden, or unavailable are no longer viewed or purchased.
• Orders placed on the website from a Telegram shopping cart are linked to the chat and receive status notifications.

Security

• The panel is reserved for SuperAdmin and employees with configuration permissions only.
• The webhook always requires the secret; exporting/importing settings no longer includes the bot token, the provider token, or the secret.
• Custom CSS without < ; intro and footer passed through the HTML purifier.
• initData without auth_date is rejected; limit of attempts on coupons.

Addons

• AFL-3.0 license, .htaccess , no Context:: , hash_hmac , file_get_contents or nofilter no sanitizer; PHP CS Fixer.