0 Fork 0

T

SatoDri 303bfce067 Build the BTCPay invoice server-side and validate the settled amount

Security: the checkout controller built the BTCPay invoice from the POSTed
redirect-form data (price, currency, orderId), and _extract_amount_data
returned None to opt out of amount validation, so the settled amount was
never checked against the transaction. A buyer could therefore submit an
arbitrary price and confirm an order after paying far less. The invoice is
now built server-side from the transaction, the redirect form only carries
the reference, and _extract_amount_data returns the amount and currency
settled on BTCPay (read back from the invoice in the IPN) so the framework
validates them against the transaction before it is set done.

Other fixes in the notification path:
- Fix the IPN notification URL: it was concatenated without a leading
  slash (base_url + "payment/btcpay/ipn"), producing an unreachable host
  so notifications never arrived. It is now built with urls.url_join.
- Handle the "expired" invoice status (cancel the transaction) instead of
  leaving it pending forever, and set an error on unknown statuses.

2026-07-20 00:06:39 +02:00

payment_btcpayserver

Build the BTCPay invoice server-side and validate the settled amount

2026-07-20 00:06:39 +02:00

README.md

Update Readme.

2026-03-30 16:45:20 +02:00

README.md

BTCPay Server payment gateway for Odoo 16, 17, 18 and 19

Accept bitcoin payments on Odoo 16, 17, 18 and 19

This odoo addon allows you to accept bitcoin and Lightning Network (and other cryptocurrency) payments in your Odoo e-commerce store.

How to install

Please find the installation instructions here: