Antoine Vandevenne (anv)andLucie Van Nieuwenhuyze
00259dc44a
Notification handling in some acquirers presents a subset of the following issues: 1. The signature of synchronous notifications (redirect payloads) is not checked. (Alipay, Authorize, Buckaroo, Mollie, PayU money, PayULatam) 2. When the signature check fails, we raise a ValidationError which counts as an HTTP 200 for some providers (it's not the case if they expect a specific string). (Adyen, Paypal, Sips, Stripe) 3. If a ValidationError is raised when processing the feedback data, it is allowed to bubble up to the provider. (Alipay, Ogone) The issues are respectively addressed as follows: 1. If the acquirer implements payments with redirection, make sure that if either makes a request to the provider to validate the data or that it verifies the signature. Verifying the origin of the request is not enough: the payload must be checked too. 2. Instead of raising ValidationError's, raise an HTTP 403 FORBIDDEN error if the signature check fails. 3. Wrap the call to `_handle_feedback_data` of the webhook method inside a try/except clause to catch any ValidationError, log a warning, and acknowledge the notification to avoid having the provider disable the webhook because of too many failures. task-2688139 task-2693293 closes odoo/odoo#81607 Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com> Co-authored-by: Lucie Van Nieuwenhuyze <luvn@odoo.com>
46 lines
1.5 KiB
Python
46 lines
1.5 KiB
Python
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from odoo.addons.payment.tests.common import PaymentCommon
|
|
|
|
|
|
class AdyenCommon(PaymentCommon):
|
|
|
|
WEBHOOK_NOTIFICATION_PAYLOAD = {
|
|
'additionalData': {
|
|
'hmacSignature': 'kK6vSQvfWP3AtT2TTK1ePj9e7XPb7bF5jHC7jDWyU5c='
|
|
},
|
|
'amount': {
|
|
'currency': 'USD',
|
|
'value': 999,
|
|
},
|
|
'eventCode': 'AUTHORISATION',
|
|
'merchantAccountCode': 'DuckSACom123',
|
|
'merchantReference': 'Test Transaction', # Shamefully copy-pasted from payment
|
|
'originalReference': 'FEDCBA9876543210',
|
|
'pspReference': '0123456789ABCDEF',
|
|
'success': 'true',
|
|
} # Include all keys used in the computation of the signature to the payload
|
|
WEBHOOK_NOTIFICATION_BATCH_DATA = {
|
|
'notificationItems': [
|
|
{
|
|
'NotificationRequestItem': WEBHOOK_NOTIFICATION_PAYLOAD,
|
|
}
|
|
]
|
|
}
|
|
|
|
@classmethod
|
|
def setUpClass(cls, chart_template_ref=None):
|
|
super().setUpClass(chart_template_ref=chart_template_ref)
|
|
|
|
cls.adyen = cls._prepare_acquirer('adyen', update_values={
|
|
'adyen_merchant_account': 'dummy',
|
|
'adyen_api_key': 'dummy',
|
|
'adyen_client_key': 'dummy',
|
|
'adyen_hmac_key': '12345678',
|
|
'adyen_checkout_api_url': 'https://this.is.an.url',
|
|
'adyen_recurring_api_url': 'https://this.is.an.url',
|
|
})
|
|
|
|
# Override default values
|
|
cls.acquirer = cls.adyen
|