[FIX] payment_payumoney: prevent clearing the session cookie

See commit https://github.com/odoo/odoo/commit/f7800a059a1e8ed52cf7ddfa81ab5df6867b78da
for details about this fix

OPW-2368473

closes odoo/odoo#73647

X-original-commit: c61a7d00e9d219fe710b206799c732f6cac51767
Signed-off-by: Antoine Vandevenne (anv) <AntoineVDV@users.noreply.github.com>

addons/payment_payumoney/controllers/main.py

@@ -12,8 +12,15 @@ _logger = logging.getLogger(__name__)
 class PayUMoneyController(http.Controller):
     _return_url = '/payment/payumoney/return'
 
-    @http.route(_return_url, type='http', auth='public', methods=['GET', 'POST'], csrf=False)
+    @http.route(_return_url, type='http', auth='public', methods=['GET', 'POST'], csrf=False, save_session=False)
     def payumoney_return(self, **data):
+        """ PayUmoney.
+        The session cookie created by Odoo has not the attribute SameSite. Most of browsers will force this attribute
+        with the value 'Lax'. After the payment, PayUMoney will perform a POST request on this route. For all these reasons,
+        the cookie won't be added to the request. As a result, if we want to save the session, the server will create
+        a new session cookie. Therefore, the previous session and all related information will be lost, so it will lead
+        to undesirable behaviors. This is the reason why `save_session=False` is needed.
+        """
         _logger.info("entering handle_feedback_data with data:\n%s", pprint.pformat(data))
         request.env['payment.transaction'].sudo()._handle_feedback_data('payumoney', data)
         return request.redirect('/payment/status')