[IMP] payment_ogone: Avoid requesting already owned data from Ogone

- When receiving a S2S payment feedback from Ogone server, we call the method '_ogone_form_get_tx_from_data' which does a "pre-process" of the data to retrieve the payment.transaction linked to this payment.
  It also checks the hash signature of the data to be sure it comes from Ogone.
  Right after, we call "_ogone_s2s_validate" which make a HTTP call to ogone, to retrieve the data related to the transaction which were already sent by Ogone (maybe to be sure the data comes from Ogone?).

  So instead of calling "_ogone_s2s_validate" we now call "_ogone_s2s_validate_tree" which processes the data from Ogone.
  We are sure they come from Ogone, since they passed the hash signature when calling "_ogone_form_get_tx_from_data".
This commit is contained in:
Toufik Benjaa
2018-06-12 18:27:24 +02:00
parent c2f20f12b9
commit 444f0b6a7f
+1 -1
View File
@@ -50,7 +50,7 @@ class OgoneController(http.Controller):
payment = request.registry.get('payment.transaction')
try:
tx = payment._ogone_form_get_tx_from_data(cr, uid, kwargs, context=context)
payment._ogone_s2s_validate(tx)
payment._ogone_s2s_validate_tree(tx, kwargs)
except ValidationError:
return 'ko'