Antoine Vandevenne (anv)andLucie Van Nieuwenhuyze
00259dc44a
Notification handling in some acquirers presents a subset of the following issues: 1. The signature of synchronous notifications (redirect payloads) is not checked. (Alipay, Authorize, Buckaroo, Mollie, PayU money, PayULatam) 2. When the signature check fails, we raise a ValidationError which counts as an HTTP 200 for some providers (it's not the case if they expect a specific string). (Adyen, Paypal, Sips, Stripe) 3. If a ValidationError is raised when processing the feedback data, it is allowed to bubble up to the provider. (Alipay, Ogone) The issues are respectively addressed as follows: 1. If the acquirer implements payments with redirection, make sure that if either makes a request to the provider to validate the data or that it verifies the signature. Verifying the origin of the request is not enough: the payload must be checked too. 2. Instead of raising ValidationError's, raise an HTTP 403 FORBIDDEN error if the signature check fails. 3. Wrap the call to `_handle_feedback_data` of the webhook method inside a try/except clause to catch any ValidationError, log a warning, and acknowledge the notification to avoid having the provider disable the webhook because of too many failures. task-2688139 task-2693293 closes odoo/odoo#81607 Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com> Co-authored-by: Lucie Van Nieuwenhuyze <luvn@odoo.com>
38 lines
1.2 KiB
Python
38 lines
1.2 KiB
Python
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from odoo.addons.payment.tests.common import PaymentCommon
|
|
|
|
|
|
class OgoneCommon(PaymentCommon):
|
|
|
|
NOTIFICATION_DATA = {
|
|
'AAVADDRESS': 'NO',
|
|
'amount': '1111.11',
|
|
'CARDNO': 'XXXXXXXXXXXX1111',
|
|
'CN': 'Dummy Customer Name',
|
|
'currency': 'USD',
|
|
'IP': '101.00.111.22',
|
|
'NCERROR': '0',
|
|
'orderID': 'Test Transaction', # Shamefully copy-pasted from payment
|
|
'PAYID': '01234567899',
|
|
'PM': 'CreditCard',
|
|
'SHASIGN': '2CE444D2260D914EA7E56450B7B28F189238553B',
|
|
'STATUS': '9', # 'Payment requested' (done)
|
|
'TRXDATE': '01/31/22',
|
|
}
|
|
|
|
@classmethod
|
|
def setUpClass(cls, chart_template_ref=None):
|
|
super().setUpClass(chart_template_ref=chart_template_ref)
|
|
|
|
cls.ogone = cls._prepare_acquirer('ogone', update_values={
|
|
'ogone_pspid': 'dummy',
|
|
'ogone_userid': 'dummy',
|
|
'ogone_password': 'dummy',
|
|
'ogone_shakey_in': 'dummy',
|
|
'ogone_shakey_out': 'dummy',
|
|
})
|
|
|
|
cls.acquirer = cls.ogone
|
|
cls.currency = cls.currency_euro
|