Security: the checkout controller built the BTCPay invoice from the POSTed
redirect-form data (price, currency, orderId), and _extract_amount_data
returned None to opt out of amount validation, so the settled amount was
never checked against the transaction. A buyer could therefore submit an
arbitrary price and confirm an order after paying far less. The invoice is
now built server-side from the transaction, the redirect form only carries
the reference, and _extract_amount_data returns the amount and currency
settled on BTCPay (read back from the invoice in the IPN) so the framework
validates them against the transaction before it is set done.
Other fixes in the notification path:
- Fix the IPN notification URL: it was concatenated without a leading
slash (base_url + "payment/btcpay/ipn"), producing an unreachable host
so notifications never arrived. It is now built with urls.url_join.
- Handle the "expired" invoice status (cancel the transaction) instead of
leaving it pending forever, and set an error on unknown statuses.
The override guarded on self.code, which is empty on the model-level
recordset passed to create(), so the branch never ran. The private key is
generated during pairing (in the onchange) instead, so the override is
dead code; removing it also keeps copying a provider from regenerating
(and thus invalidating) an already paired key.
SatoDri
ndeet