Antoine Vandevenne (anv)andLucie Van Nieuwenhuyze
00259dc44a
Notification handling in some acquirers presents a subset of the following issues: 1. The signature of synchronous notifications (redirect payloads) is not checked. (Alipay, Authorize, Buckaroo, Mollie, PayU money, PayULatam) 2. When the signature check fails, we raise a ValidationError which counts as an HTTP 200 for some providers (it's not the case if they expect a specific string). (Adyen, Paypal, Sips, Stripe) 3. If a ValidationError is raised when processing the feedback data, it is allowed to bubble up to the provider. (Alipay, Ogone) The issues are respectively addressed as follows: 1. If the acquirer implements payments with redirection, make sure that if either makes a request to the provider to validate the data or that it verifies the signature. Verifying the origin of the request is not enough: the payload must be checked too. 2. Instead of raising ValidationError's, raise an HTTP 403 FORBIDDEN error if the signature check fails. 3. Wrap the call to `_handle_feedback_data` of the webhook method inside a try/except clause to catch any ValidationError, log a warning, and acknowledge the notification to avoid having the provider disable the webhook because of too many failures. task-2688139 task-2693293 closes odoo/odoo#81607 Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com> Co-authored-by: Lucie Van Nieuwenhuyze <luvn@odoo.com>
55 lines
1.8 KiB
Python
55 lines
1.8 KiB
Python
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from odoo.addons.payment.tests.common import PaymentCommon
|
|
|
|
|
|
class PaypalCommon(PaymentCommon):
|
|
|
|
NOTIFICATION_DATA = {
|
|
'PayerID': '59XDVNACRAZZK',
|
|
'address_city': 'Scranton',
|
|
'address_country_code': 'US',
|
|
'address_name': 'Mitchell Admin',
|
|
'address_state': 'Pennsylvania',
|
|
'address_street': '215 Vine St',
|
|
'address_zip': '18503',
|
|
'first_name': 'Norbert',
|
|
'handling_amount': '0.00',
|
|
'item_name': 'YourCompany: Test Transaction',
|
|
'item_number': 'Test Transaction', # Shamefully copy-pasted from payment
|
|
'last_name': 'Buyer',
|
|
'mc_currency': 'USD',
|
|
'mc_fee': '2.00',
|
|
'mc_gross': '50.00',
|
|
'notify_version': 'UNVERSIONED',
|
|
'payer_email': 'test-buyer@mail.odoo.com',
|
|
'payer_id': '59XDVNACRAZZK',
|
|
'payer_status': 'VERIFIED',
|
|
'payment_date': '2022-01-19T08:38:06Z',
|
|
'payment_fee': '2.00',
|
|
'payment_gross': '50.00',
|
|
'payment_status': 'Completed',
|
|
'payment_type': 'instant',
|
|
'protection_eligibility': 'ELIGIBLE',
|
|
'quantity': '1',
|
|
'receiver_id': 'BEQE89VH6257B',
|
|
'residence_country': 'US',
|
|
'shipping': '0.00',
|
|
'txn_id': '1H89255869624041K',
|
|
'txn_type': 'web_accept',
|
|
'verify_sign': 'dummy',
|
|
}
|
|
|
|
@classmethod
|
|
def setUpClass(cls, chart_template_ref=None):
|
|
super().setUpClass(chart_template_ref=chart_template_ref)
|
|
|
|
cls.paypal = cls._prepare_acquirer('paypal', update_values={
|
|
'paypal_email_account': 'dummy@test.mail.com',
|
|
'fees_active': False,
|
|
})
|
|
|
|
# Override default values
|
|
cls.acquirer = cls.paypal
|
|
cls.currency = cls.currency_euro
|