-
- Downloads
[FIX] payment_sips: prevent clearing the session cookie
When buying a product on website shop, after the payment with SIPS, the page is redirected to an Error message: "We are not able to find your payment, but don't worry. You should receive an email confirming your payment in a few minutes. If the payment hasn't been confirmed you can contact us." To reproduce the error: 1. In Payment Acquirers, enable Sips 2. Go on website shop 3. Add a product to the cart, Checkout 4. Pay with Sips - Visa card number: 4100000000000000 5. Back to Web-shop, if the payment has been successfully processed, repeat steps 2 -> 4 Error: The message "Your payment has been successfully processed. Thank you!" is not displayed. Instead, the message "We are not able [...] you can contact us." is displayed. This message is displayed when: https://github.com/odoo/odoo/blob/5945806c151b13d9d4cc13aa0a6c96a6b1bbad5f/addons/payment/controllers/portal.py#L65-L69 i.e., when the transactions list is empty. Here is how to get the list: https://github.com/odoo/odoo/blob/5945806c151b13d9d4cc13aa0a6c96a6b1bbad5f/addons/payment/controllers/portal.py#L38-L42 It uses the session of the request. The cookie `session_id` is used to identify the current session. However, after the payment on SIPS, the page is redirected to `/payment/sips/dpn` with a POST request. Since the session cookie has the attribute `SameSite=Lax` and the HTTP request is a POST, the cookie will be filtered out: https://drive.google.com/file/d/1xfx3YWkfonO3nK-8Rew45uSoR4lkpjpY/view?usp=sharing (Browser information: This cookie didn't specify a "SameSite" attribute when it was stored and was defaulted to "SameSite=Lax," and was blocked because the request was made from a different site and was not initiated by a top-level navigation. The cookie had to have been set with "SameSite=None" to enable cross-site usage) As a result, the server creates a new one. This is the reason why the transactions list is empty: the list is based on a new session. Adding the attribute `save_session = False` to the route will prevent the server from creating a new session cookie and add it in the POST response. OPW-2518377 closes odoo/odoo#72267 Signed-off-by:Antoine Vandevenne (anv) <AntoineVDV@users.noreply.github.com>
Loading
Please register or sign in to comment