* Strict invoice and order identity binding.
* IPN lookup by stored invoice ID instead of untrusted order ID.
* Invoice ID stored as provider_reference and checked for reuse.
* Transaction row locking prevents concurrent duplicate checkouts.
* Existing invoices are reused; expired ones are replaced safely.
* Late notifications for replaced invoices are ignored.
* Reduced sensitive webhook logging and restricted IPN to POST.
Security: the checkout controller built the BTCPay invoice from the POSTed
redirect-form data (price, currency, orderId), and _extract_amount_data
returned None to opt out of amount validation, so the settled amount was
never checked against the transaction. A buyer could therefore submit an
arbitrary price and confirm an order after paying far less. The invoice is
now built server-side from the transaction, the redirect form only carries
the reference, and _extract_amount_data returns the amount and currency
settled on BTCPay (read back from the invoice in the IPN) so the framework
validates them against the transaction before it is set done.
Other fixes in the notification path:
- Fix the IPN notification URL: it was concatenated without a leading
slash (base_url + "payment/btcpay/ipn"), producing an unreachable host
so notifications never arrived. It is now built with urls.url_join.
- Handle the "expired" invoice status (cancel the transaction) instead of
leaving it pending forever, and set an error on unknown statuses.
The override guarded on self.code, which is empty on the model-level
recordset passed to create(), so the branch never ran. The private key is
generated during pairing (in the onchange) instead, so the override is
dead code; removing it also keeps copying a provider from regenerating
(and thus invalidating) an already paired key.
The bundled BTCPay client (models/libs) imports ecdsa, while the manifest
and requirements only listed btcpay-python, which is not used (the client
is vendored). Installations that did not already have ecdsa available
failed the external-dependency check. Declare ecdsa instead and bump the
module version.
ndeet
SatoDri