Sharing our FusionCMS community fork for game-server owners and contributors.


This is an MMO community contribution built on FusionCMS, with credit to the original project and its contributors. Our work focuses on account security, verified MMOCoin donations, compatibility updates, and testing the flows players actually use.


This thread covers the current main branch.




MMOCoin donations through Solana Pay


Players can select a donation package, open its checkout, and pay through a Solana Pay transfer request.


The module:



  • Checks the finalized transaction against the invoice reference, recipient, token mint, amount, and payment window.
  • Credits donation points and records the completed invoice together.
  • Rejects duplicate completion and reused payment signatures.
  • Restricts invoice verification to its owner and protects state-changing requests with POST and CSRF checks.




Payments go to the configured merchant wallet. The CMS does not need a wallet private key.


Underpayments, wrong-token payments, wrong recipients, failed transactions, and unavailable verification do not grant donation points.




Password recovery and account security


We have addressed several gaps around password resets, remembered logins, and sessions across browsers.



  • Password reset links expire after one hour and can be used only once.
  • Concurrent requests cannot successfully claim the same reset token twice.
  • Password recovery and normal password changes revoke the account’s old active sessions and remembered devices.
  • Revocation also applies when the same password is chosen again.
  • Other browsers lose access on their next request and must sign in again.
  • Old session IDs cannot restore access after a fresh login.
  • Rejected password-change attempts leave valid sessions usable.




Remember-me tokens now rotate atomically. Expired and previously used tokens are rejected, and a rotation racing against account revocation cannot recreate a revoked login.


Logout revokes the account’s remembered devices. Legacy password-hash cookies no longer authenticate users.




Checkout and compatibility fixes


The fork also includes:



  • Updated upstream FusionCMS changes.
  • Patched PHP version requirements.
  • Response-header isolation fixes so form checkout returns the complete HTML page.
  • CSRF handling fixes for donation polling and administration.
  • Request throttling with locking across PHP workers.
  • Configuration editing and donation-schema upgrade fixes.






Test coverage


CI runs 34 browser E2E tests at desktop and mobile viewport sizes on PHP 8.3.36, 8.4.27, and 8.5.12.


These cover login, logout, password recovery, account settings, remembered sessions, donation checkout, rejected payments, and one-time point credit.




Separate database regressions use independent MySQL workers to exercise overlapping token claims, rotation, and revocation. Locked Composer dependencies are audited in CI.


Payment testing is documented using Solana devnet assets. A native Solflare Android flow was tested on an emulator; Phantom’s native payment flow remains unverified.


View the passing CI run


Browser test coverage and local setup




About MMO Pay


MMO Pay is a separate product in the MMOCoin ecosystem. Its published payment options include SOL, USDC, USDT, and MMO, with wallet-to-wallet settlement, on-chain verification, payment links, QR checkout, and no buyer account requirement.


A hosted MMO Pay integration is an idea we are exploring for FusionCMS. It is not connected to the current fork yet.


The donation module currently included here accepts MMOCoin directly through Solana Pay.


Explore MMO Pay




Source and installation


FusionCMS community fork on GitHub


Installation, upgrade requirements, migrations, and rollback guide


Project license


The latest authentication changes are on main. The v9.5.2 stable tag predates those changes, so use main if you want to test the features described in this thread.


Existing installations should back up their files and database and follow the upgrade guide, including its SQL migrations. Do not import the fresh-install SQL into an existing site.


The preview screenshots use FusionCMS’s Simple theme with sample data from a local installation.




Feedback and contributions


If you try the fork, share your PHP version, emulator, theme, and any issues you encounter. Reproducible bug reports and pull requests are welcome.


Which would help your community most next: MMO Pay checkout integration, donation-management improvements, or broader browser coverage?

› See More: [Community Fork] FusionCMS | MMOCoin Donations, Security Fixes & Browser E2E Tests