From 8d66636a76fe0dd091cbe8bc97a7aa80d22e3fb3 Mon Sep 17 00:00:00 2001 From: "Antoine Vandevenne (anv)" Date: Wed, 13 Dec 2023 12:24:38 +0100 Subject: [PATCH] [FIX] payment_(adyen,paypal): discard invalid notification data opw-3097856 closes odoo/odoo#120751 Signed-off-by: Antoine Vandevenne (anv) --- addons/payment_adyen/controllers/main.py | 2 +- addons/payment_adyen/models/payment_transaction.py | 1 + addons/payment_adyen/tests/test_adyen.py | 2 +- addons/payment_paypal/models/payment_transaction.py | 7 +++++++ addons/payment_paypal/tests/common.py | 4 ++-- 5 files changed, 12 insertions(+), 4 deletions(-) diff --git a/addons/payment_adyen/controllers/main.py b/addons/payment_adyen/controllers/main.py index 95ba2d9b4ab..a02f600e328 100644 --- a/addons/payment_adyen/controllers/main.py +++ b/addons/payment_adyen/controllers/main.py @@ -78,7 +78,7 @@ class AdyenController(http.Controller): # Check that the transaction details have not been altered. This allows preventing users # from validating transactions by paying less than agreed upon. if not payment_utils.check_access_token( - access_token, reference, converted_amount, partner_id + access_token, reference, converted_amount, currency_id, partner_id ): raise ValidationError("Adyen: " + _("Received tampered payment request data.")) diff --git a/addons/payment_adyen/models/payment_transaction.py b/addons/payment_adyen/models/payment_transaction.py index d4fd17d934d..be813093910 100644 --- a/addons/payment_adyen/models/payment_transaction.py +++ b/addons/payment_adyen/models/payment_transaction.py @@ -40,6 +40,7 @@ class PaymentTransaction(models.Model): 'access_token': payment_utils.generate_access_token( processing_values['reference'], converted_amount, + self.currency_id.id, processing_values['partner_id'] ) } diff --git a/addons/payment_adyen/tests/test_adyen.py b/addons/payment_adyen/tests/test_adyen.py index 2adf4ef15dd..c7b398678a8 100644 --- a/addons/payment_adyen/tests/test_adyen.py +++ b/addons/payment_adyen/tests/test_adyen.py @@ -37,7 +37,7 @@ class AdyenTest(AdyenCommon, PaymentHttpCommon): 'odoo.addons.payment.utils.generate_access_token', new=self._generate_test_access_token ): self.assertTrue(payment_utils.check_access_token( - processing_values['access_token'], self.reference, converted_amount, self.partner.id + processing_values['access_token'], self.reference, converted_amount, self.currency.id, self.partner.id )) @mute_logger('odoo.addons.payment_adyen.models.payment_transaction') diff --git a/addons/payment_paypal/models/payment_transaction.py b/addons/payment_paypal/models/payment_transaction.py index f852d6e65e1..413f91431b8 100644 --- a/addons/payment_paypal/models/payment_transaction.py +++ b/addons/payment_paypal/models/payment_transaction.py @@ -100,6 +100,13 @@ class PaymentTransaction(models.Model): self._set_canceled(_("The customer left the payment page.")) return + amount = notification_data.get('amt') or notification_data.get('mc_gross') + currency_code = notification_data.get('cc') or notification_data.get('mc_currency') + assert amount and currency_code, 'PayPal: missing amount or currency' + assert self.currency_id.compare_amounts(float(amount), self.amount) == 0, \ + 'PayPal: mismatching amounts' + assert currency_code == self.currency_id.name, 'PayPal: mismatching currency codes' + # Update the provider reference. txn_id = notification_data.get('txn_id') txn_type = notification_data.get('txn_type') diff --git a/addons/payment_paypal/tests/common.py b/addons/payment_paypal/tests/common.py index 5dd580e1821..3614dc1ec77 100644 --- a/addons/payment_paypal/tests/common.py +++ b/addons/payment_paypal/tests/common.py @@ -30,9 +30,9 @@ class PaypalCommon(PaymentCommon): 'item_name': 'YourCompany: Test Transaction', 'item_number': cls.reference, 'last_name': 'Buyer', - 'mc_currency': 'USD', + 'mc_currency': cls.currency.name, 'mc_fee': '2.00', - 'mc_gross': '50.00', + 'mc_gross': str(cls.amount), 'notify_version': 'UNVERSIONED', 'payer_email': 'test-buyer@mail.odoo.com', 'payer_id': '59XDVNACRAZZK',