Antoine Vandevenne (anv)andLucie Van Nieuwenhuyze
00259dc44a
Notification handling in some acquirers presents a subset of the following issues: 1. The signature of synchronous notifications (redirect payloads) is not checked. (Alipay, Authorize, Buckaroo, Mollie, PayU money, PayULatam) 2. When the signature check fails, we raise a ValidationError which counts as an HTTP 200 for some providers (it's not the case if they expect a specific string). (Adyen, Paypal, Sips, Stripe) 3. If a ValidationError is raised when processing the feedback data, it is allowed to bubble up to the provider. (Alipay, Ogone) The issues are respectively addressed as follows: 1. If the acquirer implements payments with redirection, make sure that if either makes a request to the provider to validate the data or that it verifies the signature. Verifying the origin of the request is not enough: the payload must be checked too. 2. Instead of raising ValidationError's, raise an HTTP 403 FORBIDDEN error if the signature check fails. 3. Wrap the call to `_handle_feedback_data` of the webhook method inside a try/except clause to catch any ValidationError, log a warning, and acknowledge the notification to avoid having the provider disable the webhook because of too many failures. task-2688139 task-2693293 closes odoo/odoo#81607 Signed-off-by: Antoine Vandevenne (anv) <anv@odoo.com> Co-authored-by: Lucie Van Nieuwenhuyze <luvn@odoo.com>
42 lines
2.1 KiB
Python
42 lines
2.1 KiB
Python
# Part of Odoo. See LICENSE file for full copyright and licensing details.
|
|
|
|
from odoo.addons.payment.tests.common import PaymentCommon
|
|
|
|
|
|
class SipsCommon(PaymentCommon):
|
|
|
|
NOTIFICATION_DATA = {
|
|
'Data': 'captureDay=0|captureMode=AUTHOR_CAPTURE|currencyCode=840'
|
|
'|merchantId=002001000000001|orderChannel=INTERNET|responseCode=00'
|
|
'|transactionDateTime=2022-01-19T18:01:06+01:00'
|
|
'|transactionReference=Test Transaction' # Shamefully copy-pasted from payment
|
|
'|keyVersion=1|acquirerResponseCode=00|amount=10000|authorisationId=12345'
|
|
'|guaranteeIndicator=Y|cardCSCResultCode=4D|panExpiryDate=202201'
|
|
'|paymentMeanBrand=VISA|paymentMeanType=CARD|customerIpAddress=111.11.111.11'
|
|
'|maskedPan=4100##########00|returnContext={"reference": "Test Transaction"}'
|
|
'|holderAuthentRelegation=N|holderAuthentStatus=3D_SUCCESS'
|
|
'|tokenPan=dp528b9xwknujmkw|transactionOrigin=INTERNET|paymentPattern=ONE_SHOT'
|
|
'|customerMobilePhone=null|mandateAuthentMethod=null|mandateUsage=null'
|
|
'|transactionActors=null|mandateId=null|captureLimitDate=20220119|dccStatus=null'
|
|
'|dccResponseCode=null|dccAmount=null|dccCurrencyCode=null|dccExchangeRate=null'
|
|
'|dccExchangeRateValidity=null|dccProvider=null|statementReference=tx20220119170050'
|
|
'|panEntryMode=MANUAL|walletType=null|holderAuthentMethod=NOT_SPECIFIED',
|
|
'Encode': '',
|
|
'InterfaceVersion': 'HP_2.4',
|
|
'Seal': '8a4c1f8b268832600a7bf40ddaa5d487f07d61dea81b8119ab8bab3c8a0861f3',
|
|
'locale': 'en',
|
|
}
|
|
|
|
@classmethod
|
|
def setUpClass(cls, chart_template_ref=None):
|
|
super().setUpClass(chart_template_ref=chart_template_ref)
|
|
|
|
cls.sips = cls._prepare_acquirer('sips', update_values={
|
|
'sips_merchant_id': 'dummy_mid',
|
|
'sips_secret': 'dummy_secret',
|
|
})
|
|
|
|
# Override default values
|
|
cls.acquirer = cls.sips
|
|
cls.currency = cls.currency_euro
|