From 2099f15d67564ab153d48993cca0f80aee04bb09 Mon Sep 17 00:00:00 2001 From: Oriol Carreras Date: Wed, 14 Oct 2015 12:15:08 +0200 Subject: [PATCH] [FIX] payment_paypal: Disable csrf on paypal callbacks When the http csrf is default enabled, callbacks raises a http error 400: Invalid CSRF Token. Fixes #9065 Closes #9073 --- addons/payment_paypal/controllers/main.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/addons/payment_paypal/controllers/main.py b/addons/payment_paypal/controllers/main.py index cd2523bba4d..491a6de7adb 100644 --- a/addons/payment_paypal/controllers/main.py +++ b/addons/payment_paypal/controllers/main.py @@ -58,14 +58,14 @@ class PaypalController(http.Controller): _logger.warning('Paypal: unrecognized paypal answer, received %s instead of VERIFIED or INVALID' % resp.text) return res - @http.route('/payment/paypal/ipn/', type='http', auth='none', methods=['POST']) + @http.route('/payment/paypal/ipn/', type='http', auth='none', methods=['POST'], csrf=False) def paypal_ipn(self, **post): """ Paypal IPN. """ _logger.info('Beginning Paypal IPN form_feedback with post data %s', pprint.pformat(post)) # debug self.paypal_validate_data(**post) return '' - @http.route('/payment/paypal/dpn', type='http', auth="none", methods=['POST']) + @http.route('/payment/paypal/dpn', type='http', auth="none", methods=['POST'], csrf=False) def paypal_dpn(self, **post): """ Paypal DPN """ _logger.info('Beginning Paypal DPN form_feedback with post data %s', pprint.pformat(post)) # debug