Service "Express Payments": Internet Acquiring

- The domain for return addresses is taken from the "Site URL" of the Main module; if it is empty, it is taken from the "Server URL" of the order site. Values containing a path or slash are no longer stripped; Cyrillic domains are converted to punycode.

- If the domain is not specified, the invoice is not issued, and the administrator sees a clear message indicating which setting to fill; a warning is displayed in the payment system settings.

- "Express Payments" API errors and connection errors are logged in the event log (type EXPRESSPAY_*_ERROR) without enabling debugging. The administrator sees the error reason on the payment page, while the buyer sees a general message.

- The update replaces the installed copy of the handler in the directory /bitrix/modules/sale/handlers/paysystem/ entirely.

- After payment, the buyer is returned to the order page and sees a message about successful payment (previously they were redirected to a service address).

- The status text "Paid with a bank card" has been added.

- Notification data (payer, amount) are validated and escaped before being written to the payment.

- Notification signature verification has become mandatory (fail-closed): the dependency on CARD_IS_USE_SIGNATURE_FROM_NOTIFICATION has been removed, and the default has been changed to Y.

- A warning has been added for administrators when signature verification is disabled.

- Open Redirect: the HTTP_HOST fallback has been removed; when server_name is empty, a relative URL is used, the protocol is always HTTPS, the path is fixed, and allowlist verification via main:trusted_hosts has been added.

- The request signature (Signature) is no longer written to the debug log, and the response body is replaced with its length.

- Fixed authentication bypass in the notification handler: added data type validation, signature verification via hash_equals, amount and AccountNo comparison, and protection against double charging.

- Fixed ReturnUrl/FailUrl construction: uses a trusted host from site settings instead of HTTP_HOST, with logging of host substitution.

- Fixed default notification URL construction: host is taken from server_name, with warnings to administrators about host mismatch and empty secret key when signature verification is enabled.

- Improved signature verification cryptography: signature calculation is skipped if the secret is empty, trim() on the secret key is removed, and hash_equals is used to prevent timing attacks.

- Fixed XSS vulnerabilities in checkout.php and error.php templates.

- On API errors, the buyer sees a generic message while details are logged.

- Added language strings for new errors and warnings.

- Language files converted to UTF-8 encoding.