Christophe Simonis
440c8cc7c9
[FIX] payment_ogone: process s2s requests as sudo
2016-11-24 16:42:43 +01:00
Damien Bouvy
3321d9c1ca
[FIX] payment_ogone: serialize correctly & validate with sudo
2016-11-23 14:59:52 +01:00
Jeremy Kersten
6f03ab45a8
[IMP] website_sale: allow to use payment.token to pay on eCommerce
...
This commit add as (sub) payment method all (owns) tokens from this acquirer.
Tested with Ogone with success
2016-08-30 17:50:44 +02:00
Ravi Gadhia
4ef937ed38
[MIG] payment_ogone: new API
...
No functional change.
2016-07-06 15:10:47 +02:00
Goffin Simon
32c8280a02
[FIX] payment_adyen, payment_authorize, payment_buckaroo, payment_paypal, payment_sips: Disable csrf on callbacks
...
Inspired from 2099f15d67
2015-11-24 11:35:57 +01:00
Christophe Simonis
7636b510a2
[ADD] *: CSRF protection in forms and routes
...
* make CSRF protection the default on all non-SAFE methods
note: there currently is no way to call a CSRF-protected endpoint
without a form-encoded entity-body as that's the only place we get the
CSRF token from.
* simple CSRF token generation: just use the HMAC'd session id, no
generating a new random token per session then HMAC it
* use constant-time equal function to avoid timing attacks
* assert that a database secret is configured before hashing/validating
the CSRF token
* opt-out database manager from CSRF: The super-admin password serves
the purpose of a CSRF token in the database manager screens.
There is no request database to obtain the
secret and generate a CSRF token.
2015-10-01 01:36:50 +02:00
Damien Bouvy
e4a93776b3
[FIX] payment_ogone: s2s feedback controller does not need authentication and function name error no longer prevents tx validation
2015-08-05 11:42:24 +02:00
Damien Bouvy
247867b8a3
[FIX] payment_ogone: jsonrpc calls give params as kwargs
2015-06-25 17:49:35 +02:00
Damien Bouvy
ef86cfaa1c
[IMP] payment_ogone: add support for s2s payments
2015-06-15 14:57:15 +02:00
Fabien Meghazi
e974e1fbea
[REM] remove disable_db and ensure_db() from addons
...
bzr revid: fme@openerp.com-20140130092308-s24a7h2mhzuaasf1
2014-01-30 10:23:08 +01:00
Fabien Meghazi
c4e48e2388
[REM] Removed auth='admin' from modules
...
bzr revid: fme@openerp.com-20140129171520-wkz8ot4pa63utoi3
2014-01-29 18:15:20 +01:00
Thibault Delavallée
a7908b63bd
[FIX] payment_*: fixed return controlers, now using werkzeug redirection
...
bzr revid: tde@openerp.com-20140124145923-fsyv2tm5z92m1je1
2014-01-24 15:59:23 +01:00
Thibault Delavallée
164a1ab180
[IMP] payment_*: routes as admin, remove website parameter in routes
...
bzr revid: tde@openerp.com-20140123154924-r1cylz0fobzav90y
2014-01-23 16:49:24 +01:00
Thibault Delavallée
0b69bad996
[RENAME] payment_acquirer_* -> payment_ *
...
bzr revid: tde@openerp.com-20140122175702-1h1e51z4njt4s70w
2014-01-22 18:57:02 +01:00
Christophe Simonis