[GNUnet-SVN] [taler-merchant-frontend-examples] branch master updated (3c196d9 -> b7b5532)

[gnunet]

This is an automated email from the git hooks/post-receive script.

marcello pushed a change to branch master
in repository merchant-frontend-examples.

    from 3c196d9  Security checks in python example. The frontend must generate 
and save in the state the order_id, because it needs at /pay time to check if 
it matches the one mentioned in the deposit permission.
     new 7830e8b  python example shows order id on fulfillment page
     new b7b5532  php example shows order id in fulfillment page

The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Summary of changes:
 php/fulfillment.php       |  2 +-
 php/generate-order.php    |  2 +-
 php/pay.php               | 25 ++++++++++---------------
 python/example/example.py | 19 +++++++++----------
 4 files changed, 21 insertions(+), 27 deletions(-)

diff --git a/php/fulfillment.php b/php/fulfillment.php
index 3c0ecef..ce4174d 100644
--- a/php/fulfillment.php
+++ b/php/fulfillment.php
@@ -7,7 +7,7 @@
 
   if(pull($_SESSION, 'paid', false)){
     echo sprintf("<p>Thanks for your donation!</p>
-                  <br><p>The order ID is: %s; use it to
+                  <br><p>The order ID is: <b>%s</b>; use it to
                   <a href=\"backoffice.html\">track</a> your money,
                   or make <a href=\"/\">another donation!</a></p>",
                   $_SESSION['order_id']);
diff --git a/php/generate-order.php b/php/generate-order.php
index 4d57998..017780f 100644
--- a/php/generate-order.php
+++ b/php/generate-order.php
@@ -5,7 +5,7 @@
   include 'backend.php';
   include 'error.php';
 
-  $order_id = rand(1,90000); // simplified, do not do this!
+  $order_id = "tutorial-" . dechex(rand(0,99999999)) . date("-H_i_s");
   session_start();
   $_SESSION["order_id"] = $order_id;
   // this variable is the JSON of a contract proposal,
diff --git a/php/pay.php b/php/pay.php
index 25b2d6a..921cc70 100644
--- a/php/pay.php
+++ b/php/pay.php
@@ -1,34 +1,29 @@
 <?php
   // This file is in the public domain.
 
-  include 'backend.php';
-  include 'error.php';
+  include "backend.php";
+  include "error.php";
 
   session_start();
-  if(!isset($_SESSION['paid'])){
+  if(!isset($_SESSION["paid"])){
     echo "<p>No session active. Aborting.</p>";
     return;
   }
   // Get coins.
-  $body = json_decode(file_get_contents('php://input'));
-
-  if ($_SESSION["order_id"] != $body->order_id){
-    echo build_error($response,
-                     "Mismatch between the product ordered and the one 
attempted to be paid",
-                     406);
-    return;
-  }
+  $body = json_decode(file_get_contents("php://input"));
 
   $response = post_to_backend("/pay", $body);
-  http_response_code($response['status_code']);
+  $proposal_data = json_decode($response["body"])->proposal_data;
+  $_SESSION["order_id"] = $proposal_data->order_id;
+  http_response_code($response["status_code"]);
 
-  if (200 != $response['status_code']){
+  if (200 != $response["status_code"]){
     echo build_error($response,
                      "Could not send payment to backend",
-                     $response['status_code']);
+                     $response["status_code"]);
     return;
   }
   // Payment went through!
-  $_SESSION['paid'] = true;
+  $_SESSION["paid"] = true;
   return;
 ?>
diff --git a/python/example/example.py b/python/example/example.py
index e151e42..2090e94 100644
--- a/python/example/example.py
+++ b/python/example/example.py
@@ -7,6 +7,7 @@ import os
 import logging
 import json
 from random import randint
+from datetime import datetime
 
 
 app = flask.Flask(__name__)
@@ -16,7 +17,7 @@ logger = logging.getLogger(__name__)
 CURRENCY = "PUDOS"
 BACKEND_URL = "http://backend.test.taler.net/";
 
-def make_url(page, query_params=dict()):
+def make_url(page, *query_params):
     """
     Return a URL to a page in the current Flask application with the given
     query parameters (sequence of key/value pairs).
@@ -48,9 +49,9 @@ def donate():
 def generate_proposal():
     DONATION = amount.string_to_amount("0.1:%s" % CURRENCY) 
     MAX_FEE = amount.string_to_amount("0.05:%s" % CURRENCY) 
-    ORDER_ID = str(randint(0, 999999))
+    ORDER_ID = "tutorial-%X-%s" % (randint(0, 0xFFFFFFFF), 
datetime.today().strftime("%H_%M_%S"))
     order = dict(
-        order_id = ORDER_ID,
+        order_id=ORDER_ID,
         nonce=flask.request.args.get("nonce"),
         amount=DONATION,
         max_fee=MAX_FEE,
@@ -62,7 +63,7 @@ def generate_proposal():
                 price=DONATION,
             ),
         ],
-        fulfillment_url=make_url("/fulfillment", 
query_params=dict(order_id=ORDER_ID)),
+        fulfillment_url=make_url("/fulfillment", ("order_id", ORDER_ID)),
         pay_url=make_url("/pay"),
         merchant=dict(
             instance="tutorial",
@@ -79,7 +80,6 @@ def generate_proposal():
         logger.error("failed to POST to '%s'", url)
         return r.text, r.status_code
     proposal_resp = r.json()
-    flask.session["order_id"] = ORDER_ID
     return flask.jsonify(**proposal_resp)
 
 
@@ -87,7 +87,7 @@ def generate_proposal():
 def fulfillment():
     paid = flask.session.get("paid", False)
     if paid:
-        return "Thank you!"
+        return "Thank you! Your order id is: <b>%s</b>." % 
flask.session["order_id"]
 
     response = flask.Response(status=402)
     response.headers["X-Taler-Contract-Url"] = make_url("/generate-contract")
@@ -103,14 +103,13 @@ def pay():
     if deposit_permission is None:
         e = flask.jsonify(error="no json in body")
         return e, 400
-    if (flask.session["order_id"] != deposit_permission["order_id"]):
-      e = flask.jsonify(error="Attempting to pay a product different \
-      from the ordered one (%s != %s)" % (flask.session["order_id"], 
deposit_permission["order_id"]))
-      return e, 406
+
     r = requests.post(urljoin(BACKEND_URL, 'pay'), json=deposit_permission)
     if 200 != r.status_code:
         return r.text, r.status_code
+    proposal_data = r.json()["proposal_data"]
 
     flask.session["paid"] = True
+    flask.session["order_id"] = proposal_data["order_id"]
 
     return flask.Response(status=200)

-- 
To stop receiving notification emails like this one, please contact
address@hidden