reynir/bornhack-website
1
0
Fork 0
Code Issues Pull requests 1 Releases Wiki Activity

rework epay callback validation

Browse source
This commit is contained in:
Thomas Steen Rasmussen 2016-05-17 07:42:31 +02:00
parent 12d76f4330
commit c1203db188
2 changed files with 12 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
shop/epay.py
View file

@ -17,3 +17,12 @@ def calculate_epay_hash(order, request):
epay_hash = hashlib.md5(hashstring).hexdigest() epay_hash = hashlib.md5(hashstring).hexdigest()
return epay_hash return epay_hash
def validate_epay_callback(query):
hashstring = ''
for key, value in query.iteritems():
if key != 'hash':
hashstring += value
hash = hashlib.md5(hashstring).hexdigest()
return hash == query['hash']

6
shop/views.py
View file

@ -23,7 +23,7 @@ from shop.models import (
EpayCallback, EpayCallback,
) )
from .forms import AddToOrderForm from .forms import AddToOrderForm
from .epay import calculate_epay_hash from .epay import calculate_epay_hash, validate_epay_callback
class EnsureUserOwnsOrderMixin(SingleObjectMixin): class EnsureUserOwnsOrderMixin(SingleObjectMixin):
@ -279,8 +279,8 @@ class EpayCallbackView(View):
) )
order = get_object_or_404(Order, pk=query.get('orderid')) order = get_object_or_404(Order, pk=query.get('orderid'))
epay_hash = calculate_epay_hash(order, request) if not validate_epay_callback(query):
if not epay_hash == query.get('hash'): print "bad epay callback!"
return HttpResponse(status=400) return HttpResponse(status=400)
EpayPayment.objects.create( EpayPayment.objects.create(