SatoDri
303bfce067
Security: the checkout controller built the BTCPay invoice from the POSTed redirect-form data (price, currency, orderId), and _extract_amount_data returned None to opt out of amount validation, so the settled amount was never checked against the transaction. A buyer could therefore submit an arbitrary price and confirm an order after paying far less. The invoice is now built server-side from the transaction, the redirect form only carries the reference, and _extract_amount_data returns the amount and currency settled on BTCPay (read back from the invoice in the IPN) so the framework validates them against the transaction before it is set done. Other fixes in the notification path: - Fix the IPN notification URL: it was concatenated without a leading slash (base_url + "payment/btcpay/ipn"), producing an unreachable host so notifications never arrived. It is now built with urls.url_join. - Handle the "expired" invoice status (cancel the transaction) instead of leaving it pending forever, and set an error on unknown statuses.
15 lines
520 B
XML
15 lines
520 B
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<odoo>
|
|
|
|
<!-- The redirect form is auto-submitted by the payment framework. It only
|
|
carries the transaction reference; the BTCPay invoice is built
|
|
server-side from the transaction (amount and currency cannot be
|
|
tampered with from the browser). -->
|
|
<template id="redirect_form">
|
|
<form t-att-action="api_url" method="post">
|
|
<input type="hidden" name="reference" t-att-value="reference"/>
|
|
</form>
|
|
</template>
|
|
|
|
</odoo>
|