From 01fe17f1e71e832b611b2b43789c92b67506e2da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Vanhaudenard?= Date: Wed, 7 Jul 2021 14:01:36 +0000 Subject: [PATCH] [FIX] payment_payumoney: prevent clearing the session cookie See commit https://github.com/odoo/odoo/commit/f7800a059a1e8ed52cf7ddfa81ab5df6867b78da for details about this fix OPW-2368473 closes odoo/odoo#73647 X-original-commit: c61a7d00e9d219fe710b206799c732f6cac51767 Signed-off-by: Antoine Vandevenne (anv) --- addons/payment_payumoney/controllers/main.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/addons/payment_payumoney/controllers/main.py b/addons/payment_payumoney/controllers/main.py index 021948c6f9c..ac3189bd334 100644 --- a/addons/payment_payumoney/controllers/main.py +++ b/addons/payment_payumoney/controllers/main.py @@ -12,8 +12,15 @@ _logger = logging.getLogger(__name__) class PayUMoneyController(http.Controller): _return_url = '/payment/payumoney/return' - @http.route(_return_url, type='http', auth='public', methods=['GET', 'POST'], csrf=False) + @http.route(_return_url, type='http', auth='public', methods=['GET', 'POST'], csrf=False, save_session=False) def payumoney_return(self, **data): + """ PayUmoney. + The session cookie created by Odoo has not the attribute SameSite. Most of browsers will force this attribute + with the value 'Lax'. After the payment, PayUMoney will perform a POST request on this route. For all these reasons, + the cookie won't be added to the request. As a result, if we want to save the session, the server will create + a new session cookie. Therefore, the previous session and all related information will be lost, so it will lead + to undesirable behaviors. This is the reason why `save_session=False` is needed. + """ _logger.info("entering handle_feedback_data with data:\n%s", pprint.pformat(data)) request.env['payment.transaction'].sudo()._handle_feedback_data('payumoney', data) return request.redirect('/payment/status')