Masjid Donation Manager
| 开发者 | eskillsproductions |
|---|---|
| 更新时间 | 2026年6月8日 10:13 |
| PHP版本: | 8.0 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Masjid Donation Manager is a complete donation management system built specifically for masjids, surau, and Islamic charitable organizations in Malaysia. It supports multiple campaigns, two popular Malaysian payment gateways (ChipIn Asia and Bayarcash), and ships with a frontend dashboard so the masjid committee can manage everything without ever touching wp-admin.
The plugin is bilingual-friendly — the user-facing strings are in Bahasa Malaysia by default, and all strings pass through
__() so they can be translated.
Key Features
- Multiple campaigns — create unlimited fundraising campaigns, each with its own image, description, target amount and schedule (ongoing, time-limited, or one-off).
- Two Malaysian payment gateways out of the box — ChipIn Asia and Bayarcash, both with sandbox and live modes.
- Frontend dashboard — a dedicated
/masjid-admin/page lets the masjid committee (administrator and the included "Bendahari Masjid" role) view donations, manage campaigns, send receipts and pull reports without learning wp-admin. - Donor wall — automatic recognition wall showing recent donors (with option for anonymous donations).
- Live statistics bar — total collected and donor count update in real time.
- Elementor widget & Gutenberg block — drop a donation button into any page with full visual configuration (toggle stats, toggle donor wall, customize colors and button text).
- Shortcodes —
[masjid_donation id="1"],[masjid_donor_wall id="1"],[masjid_donation_stats id="1"],[masjid_campaigns_list]. - Receipt emails — automatic, customizable HTML receipts on every successful payment.
- Custom reports — daily/weekly/monthly breakdowns, gateway-by-gateway and campaign-by-campaign comparisons.
- CSV export — export all donation data for accounting or audit.
- Webhook hardening — signature verification, replay-window protection and optional IP allowlisting for incoming gateway callbacks.
- PDPA / GDPR considerations — data-retention period configurable, donor anonymization tool, and external resources (Google Fonts) are opt-in only.
安装:
Automatic installation
- From your WordPress dashboard, go to Plugins → Add New.
- Search for "Masjid Donation Manager".
- Click Install Now, then Activate.
- Follow the setup wizard that appears on first activation.
- Download the plugin
.zipfile. - In your WordPress dashboard, go to Plugins → Add New → Upload Plugin.
- Choose the
.zipfile and click Install Now. - Activate the plugin.
- Follow the setup wizard.
- The setup wizard will walk you through entering your masjid name, logo, and payment gateway credentials.
- A frontend dashboard page is automatically created at
yoursite.com/masjid-admin/. - Create your first campaign from the dashboard (or via Kempen Derma in wp-admin).
- Place a donation button on any page using:
- Elementor — drag the "Masjid Donation" widget onto your page.
- Gutenberg — search for "Masjid Donation" in the block inserter.
- Shortcode — use
[masjid_donation id="X"]where X is your campaign ID.
- WordPress 6.4 or higher.
- PHP 8.0 or higher.
- HTTPS recommended (required by both payment gateways in live mode).
- Active ChipIn Asia and/or Bayarcash merchant account.
屏幕截图:
常见问题:
Do I need to pay anything to use this plugin?
The plugin itself is free and GPL-licensed. However, the payment gateways (ChipIn Asia, Bayarcash) charge their own transaction fees according to their pricing — please see their respective websites for current rates.
Which payment gateway should I choose?
Both work well. ChipIn Asia is generally easier to onboard for smaller organizations and supports FPX, e-wallets and cards. Bayarcash is widely used by Malaysian masjids and supports FPX and DuitNow QR. You can also enable both and pick per campaign.
Can I run the plugin without a payment gateway, for cash donations?
The current version requires at least one payment gateway to be configured because donations flow through online checkout. A pure offline / cash-receipting mode is on the roadmap.
My Elementor "Papar Statistik" / "Papar Dinding Penderma" toggles don't seem to do anything.
This was a bug in versions prior to 1.1.13 — please update. Both toggles are now respected as widget-level overrides regardless of the campaign-level setting.
Where is the donation data stored?
In two custom tables in your WordPress database — wp_masjid_donations (or your prefix) and wp_masjid_donation_logs. No data ever leaves your server except what is transmitted to your chosen payment gateway at the moment a donor checks out.
Is the plugin GDPR / PDPA compliant?
The plugin gives you the tools you need: donor anonymization, configurable data-retention period, and external resources (Google Fonts) are opt-in only. You are still responsible for your own privacy notice and for telling visitors what you collect and why.
How do I uninstall completely?
Deactivate the plugin, then click Delete. The uninstall routine will drop the custom tables, remove the dashboard page, delete plugin options, remove custom roles and capabilities, and remove all campaign posts. This is irreversible — back up your donation data first.
Can I translate the plugin?
Yes. All user-facing strings use the masjid-donation text domain. Drop a .mo file into wp-content/languages/plugins/ named masjid-donation-{locale}.mo.
Does this plugin support recurring / subscription donations?
Not yet. The current scope is one-off donations only. Recurring is on the roadmap pending gateway support.
更新日志:
1.1.30
Released: 28 May 2026
- New: Added a "Donate to author" link to the plugin's row on the Plugins screen (Plugins → Installed Plugins), letting supporters contribute towards continued development. The link is informational only and does not send any data from your site.
- Code quality (Plugin Check): Removed the explicit
suppress_filters => trueargument from the campaign lookup in the prefix-rename migration (it is prohibited by the performance sniff and was redundant —get_posts()already defaults it internally). - Code quality (Plugin Check): Added targeted
phpcs:ignoreannotations with justifications to the dashboard-page meta lookup inPage_Provisioner::find_existing_page(). Themeta_key/meta_valuequery runs only during activation / page-provisioning / self-heal (never on a front-end request) and returns a single row, so the SlowDBQuery warning does not apply.
- Code quality (Plugin Check): The prefix-rename migration in the activator no longer issues direct
$wpdbqueries. Per-campaign meta is now copied throughget_posts()/get_post_meta()/update_post_meta()and donor phone numbers throughget_users()/get_user_meta(), clearing theWordPress.DB.DirectDatabaseQuery(DirectQuery / NoCaching) warnings. - Code quality (Plugin Check): The branded login handler's
$_POSTreads now carry theirphpcs:ignoreannotations on the exact access lines, resolving the reportedValidatedSanitizedInput.InputNotSanitized(the password is intentionally passed raw towp_signon()) andNonceVerification.Missing(the login POST is nonce-verified before the field is read) warnings. - Compatibility:
Tested up tobumped to WordPress 7.0. Trimmed the 1.1.22 upgrade notice under the 300-character limit.
- Compatibility: The plugin prefix was lengthened from the 3-character
mdm(constantsMDM_, options/meta/hooks/capabilitiesmdm_, the localized script objectsmdmData/mdmDash/mdmBlockData) to the 8-charactermasjiddmprefix, satisfying the WordPress.org guideline requiring a distinct prefix of at least four characters. A one-time, non-destructive migration runs on upgrade and copies every existing setting, per-campaign meta, donor phone number and role capability from the oldmdm_keys to the newmasjiddm_keys, so existing installations keep all of their data and treasurer permissions. Legacy scheduled cron events are cleared and re-registered under the new names. - Code quality: The white-labeled login / reset-password pages no longer emit an inline
<style>block, inline<script>, or a Google Fonts<link>tag. Their CSS now lives inassets/css/auth.cssand the password show/hide behaviour inassets/js/auth.js; both are registered and enqueued withwp_register_style()/wp_enqueue_style()/wp_register_script()/wp_enqueue_script()and flushed into the self-contained document withwp_print_styles()/wp_print_scripts(). The optional Poppins font is enqueued (still opt-in) instead of hard-coded as a<link>.
- Change: After clicking "Log Keluar", the user is now redirected back to the dashboard page (
/masjid-admin/) instead of the site homepage. Since they're logged out at that point, they land on the branded login page — keeping the whole experience self-contained and white-labeled.
- Fix: The real cause of the hidden logout button — the fixed mobile bottom navigation bar (Utama/Kempen/Derma/Laporan) shares the same stacking level as the sidebar and was painting on top of the sidebar footer, covering the "Log Keluar" button. The bottom nav is now hidden while the slide-out menu is open, and the sidebar's stacking order was raised above it. The logout button is now fully visible when the menu is open.
- Fix: The logout button in the mobile slide-out menu could still be hidden behind the phone's browser/navigation bar. The sidebar drawer now sizes itself to the actual visible viewport (using fixed top/bottom insets instead of
vh/dvhunits, which include the area behind the browser toolbar), and the footer adds safe-area bottom padding. The "Log Keluar" button is now fully visible above the browser bar on phones. (Note: a website cannot hide the browser's own toolbar — this fix makes the menu respect it instead.)
- New — clear logout button: The dashboard sidebar now has a prominent full-width "Log Keluar" button (with a logout icon) below the user pill, replacing the small text link that was easy to miss — especially in the mobile slide-out menu. The user's role (Pentadbir/Bendahari) is also shown under their name.
- Fix: On mobile, the sidebar footer (and therefore the logout button) could sit below the visible area behind the browser/navigation bars. The sidebar now uses dynamic viewport height (
100dvh) with safe-area insets and a non-shrinking footer, so the logout button is always reachable.
- New — branded password recovery: The WordPress "forgot password" and "reset password" screens (
wp-login.php?action=lostpassword/rp) are now intercepted and rendered with the same branded card as the login page, so the whole recovery flow stays white-labeled. WordPress's own secure routines (retrieve_password(),check_password_reset_key(),reset_password()) still run underneath — only the presentation is replaced. The forgot-password response is deliberately generic to avoid revealing whether an account exists. - New — Poppins on auth pages: The login and password-recovery pages now load the Poppins font (matching the dashboard) when the existing "Muat Google Fonts (Poppins)" setting is enabled. When the setting is off they fall back to the system font stack, keeping the WordPress.org "no remote resources without consent" compliance intact.
- Refactor: Shared login/recovery chrome and styling extracted into a single
Auth_Page_Rendererso all three screens stay visually identical.
- New — branded login page: Logged-out visitors to the frontend dashboard (
/masjid-admin/) now see a custom "Selamat kembali" login card styled to match the dashboard, instead of being redirected to the WordPresswp-login.phpscreen. Includes an email/username field, show-password toggle, "keep me signed in for 30 days" option, a "forgot password" link, and inline error messages. Authentication is handled securely in-place viawp_signon()with nonce protection. Combined with the 1.1.20 white-labeling, treasurers never see WordPress branding.
- New — white-label for Bendahari: Users with the Bendahari (treasurer) role no longer see the WordPress admin bar on the frontend, and are redirected to the frontend dashboard if they try to open
/wp-admin/. This keeps the donation system looking like a standalone app rather than a WordPress site. Administrators are unaffected and keep the normal admin bar and backend. AJAX requests are still allowed so the frontend dashboard keeps working.
- PluginCheck pass: Six
WordPress.Security.NonceVerification.Missingwarnings inDashboard_Ajax::export_report(),assign_treasurer()andrevoke_treasurer()now carry inlinephpcs:ignorecomments. The file-level suppression added in 1.1.18 is honoured for most handlers, but the sniff doesn't trace nonce verification through$this->check_nonce()and re-flags the three handlers where$_POSTreads happen on the line immediately after the helper call. Nonce IS verified on every public handler — see the file-header note. - PluginCheck pass:
uninstall.php— the// phpcs:enableafter the schema-change block was previously unscoped, which also re-enabled the file-wideNonPrefixedVariableFoundsuppression and re-flagged$mdm_page_id,$mdm_admin_role,$mdm_cap,$mdm_campaigns,$mdm_campaign_id. The enable directive is now scoped to only theDirectDatabaseQuery.*/PreparedSQL.InterpolatedNotPreparedsniffs.
- PluginCheck pass: Pending poller and activator migration queries now pass the table name through the
%iidentifier placeholder in$wpdb->prepare()instead of being interpolated into the SQL string (PluginCheck.Security.DirectDB.UnescapedDBParameter). Same treatment applied to column identifiers in the legacymigrate_to_utc_timestamps()routine. - PluginCheck pass: File-level
phpcs:disableannotations inDashboard_Ajaxmoved out of the docblock into standalone comments so static analysers honour them, and extended to coverWordPress.DB.DirectDatabaseQuery.DirectQuery/NoCachingfor the reports/stats endpoints (custom-table queries with no WP API equivalent). - PluginCheck pass: Targeted
phpcs:ignorecomments added tomdm_plugin()(bootstrap function),mdm_donation_rewrite_rules_flushed(hook), and the$mdm_*globals inuninstall.php. The PluginCheck sniff cannot learn thatmdmis the plugin's chosen prefix; each ignore is paired with an inline note explaining why. - PluginCheck pass:
fwrite()call in CSV export streamer now carries the sameWordPress.WP.AlternativeFunctions.file_system_operations_fwriteignore as the surroundingfopen()/fclose(). (The stream isphp://output, whichWP_Filesystemcannot abstract.) - readme.txt: Upgrade notice for 1.1.17 shortened to satisfy the 300-character limit.
- PluginCheck pass: Namespace renamed from
MDM\(3 chars) toMasjidDM\(8 chars) across all 35 PHP files to satisfy the 4-character minimum prefix rule. Autoloader updated. No backwards-compatibility impact — nothing outside the plugin referenced the old namespace. - PluginCheck pass: Bootstrap function renamed from
mdm()→mdm_plugin(). Hook namemdm_rewrite_rules_flushed→mdm_donation_rewrite_rules_flushed. Global variables inuninstall.phpnow carry the$mdm_prefix. - Date safety:
date()calls replaced withgmdate()inDonation_Manager::generate_id()andDashboard_Ajax::dashboard_stats()so donation IDs and date filters are not subject to the WP server's runtime timezone. - Redirect hardening:
wp_redirect()→wp_safe_redirect()inAdmin::render_dashboard_redirect()andFrontend_Dashboard::maybe_render(). - Sanitization visibility:
Campaign_CPT::save_meta()now sanitizes each$_POSTfield through an explicit, statically-known function (sanitize_text_field / floatval / absint) instead of a dynamic$sanitizer( ... )dispatch, so static analysers can trace input sanitization at the call site. - Sanitization visibility:
Dashboard_Ajax::validate_ymd_date()now accepts an already-sanitized string; every call site doessanitize_text_field( wp_unslash( $_POST[...] ?? '' ) )inline, making the input-handling chain visible. - Sanitization: Bayarcash return-URL params in
Thank_You_Page::extract_bayarcash_return_params()now pass throughsanitize_text_field()afterwp_unslash()(previously unslashed but not sanitized). - readme.txt: Short description rewritten in English (was Bahasa Malaysia, which triggered the unofficial-language warning).
- Maintenance: File-level PHPCS suppression notes added to
Dashboard_Ajax,Thank_You_Page,Donation_Manager,Activator, andPending_Pollerexplaining where each suppression applies and why (nonce verification via helper methods; custom-table queries with no WP API equivalent). Three targetedphpcs:ignorelines added toShortcodes::donation_button()/campaigns_list()where the echoed return value is already escaped inside the method.
- Security:
GET /wp-json/masjid-donation/v1/campaign/{id}now whitelists the fields it returns, stripping per-campaign gateway credentials (ChipIn API key / secret, Bayarcash PAT / API secret / portal key) that would otherwise have been exposed by the public endpoint. The AJAXmdm_get_campaign_datahandler already whitelisted its response; the REST equivalent now does the same. - Security: Audit-log payload for "save campaign" no longer copies raw
$_POSTvalues intoincoming_fields; each captured field is unslashed and sanitized individually before storage. - Hardening: Gutenberg block render now calls the donation-button shortcode handler directly with sanitized attributes instead of building a
[masjid_donation ...]string and routing it throughdo_shortcode(). Output escaping was already correct inside the shortcode, but the new path removes the string-interpolation surface entirely. - Documentation:
readme.txtExternal services section expanded to list the specific API hostnames the plugin contacts for each gateway, including sandbox endpoints (console.bayarcash-sandbox.com,api.console.bayarcash-sandbox.com) so admins know exactly which hosts are reached in test mode. - Cleanup: Empty-state markup in the block render no longer uses inline
style="..."; styling moved toassets/css/public.css(.mdm-block-empty).
- Compliance (WordPress.org plugin review pass): All previously-inlined
<style>,<script>and Google Fonts<link>tags are now registered throughwp_enqueue_style()/wp_enqueue_script(). New asset files:assets/css/thank-you.css,assets/js/thank-you.js,assets/css/setup-wizard.css,assets/js/setup-wizard.js,assets/js/campaign-admin.js. - Compliance: Setup wizard inline
onclickhandlers replaced withdata-*attributes and unobtrusive event listeners. - Security: Client-IP derivation from
$_SERVER(HTTP_CF_CONNECTING_IP / HTTP_X_FORWARDED_FOR / REMOTE_ADDR) now sanitizes the raw header value before parsing, and the resolved value is validated throughFILTER_VALIDATE_IPso spoofed or malformed proxy headers cannot land in the database. - Documentation: Every public REST endpoint (
/campaign/{id},/donor-wall/{id},/return/{gateway},/return,/webhook/{gateway}) now carries an explicit code comment explaining why itspermission_callbackis__return_trueand where the actual trust boundary lives (checksum verification, IP allow-list, etc). - Library update: Chart.js bundled locally bumped from
4.4.0→4.5.1(current stable upstream). - Documentation: Updated readme.txt with corrected Terms / Privacy URLs for ChipIn Asia (
chip-in.asia/terms-of-service,chip-in.asia/privacy-policy) and Bayarcash (bayarcash.com/terms-conditions/,bayarcash.com/privacy-policy/). Added a dedicated== External services ==section disclosing exactly what data is sent to each third party and when.
- Security hardening (PluginCheck pass): Date inputs for the reports endpoint are now strictly validated against
Y-m-dcalendar format before reaching the database layer, instead of relying onsanitize_text_field()alone. - SQL identifier escaping: The masjid_donations table name is now passed via the
%iplaceholder in$wpdb->prepare()instead of being interpolated into the SQL string, satisfyingPluginCheck.Security.DirectDB.UnescapedDBParameter. - i18n: Created
languages/directory and shipped amasjid-donation.pottranslation template so theDomain Pathheader points to a real folder. - Export format whitelist: The
formatparameter on the CSV export endpoint is now constrained to a known whitelist (csv) before use.
- Fix: Elementor widget — "Papar Statistik" and "Papar Dinding Penderma" toggles now correctly override the campaign-level setting. Previously the widget controls were ignored and the page always rendered both sections.
- Fix: Gutenberg block — added the same "Show Stats" and "Show Donor Wall" toggles for parity with Elementor.
- Compliance: Chart.js is now bundled locally (
assets/vendor/chart.umd.min.js) instead of loaded from a CDN, per WordPress.org plugin guideline 7 (no remote-loaded scripts). - Privacy: Google Fonts (Poppins) loading is now opt-in via a new Tetapan → Privasi setting. By default the plugin uses system fonts, which avoids leaking visitor IPs to Google.
- Cleanup: Uninstall routine now uses
$wpdb->prepare()everywhere, cleans up transients, and force-deletes campaign meta.
- Internal cleanup and migration safety on plugin upgrade.
- Bayarcash and ChipIn Asia gateway integration improvements, frontend dashboard, donor wall, custom reports.