From 04b6ad06543b81c66a950f13c4c500c3a7a80b1b Mon Sep 17 00:00:00 2001 From: Abdurrahman Saber Date: Tue, 14 Oct 2025 18:21:19 +0300 Subject: [PATCH 1/5] Revert "[FIX] applepay_fast_checkout, payment_hyperpay: use local jquery to prevent CSP violation" This reverts commit 33f97cdf9d6430b34264219bd50d9972ab8acac5. --- .../applepay_fast_checkout/controllers/main.py | 9 ++------- .../applepay_fast_checkout/views/applepay_iframe.xml | 8 ++++---- 2 files changed, 6 insertions(+), 11 deletions(-) diff --git a/odex25_donation/applepay_fast_checkout/controllers/main.py b/odex25_donation/applepay_fast_checkout/controllers/main.py index a691e6661..c68069d30 100644 --- a/odex25_donation/applepay_fast_checkout/controllers/main.py +++ b/odex25_donation/applepay_fast_checkout/controllers/main.py @@ -18,13 +18,8 @@ class ApplePayFastCheckout(Controller): integrity = requests.get(f'{url}/v1/fastcheckout/integrity').json().get('integrity', '') - response = request.render("applepay_fast_checkout.apple_pay_iframe", { - 'hyperpay_src': f"{url}/v1/paymentWidgets.js", - 'merchant_id': acquirer_id.applepay_entity_id, - 'script_nonce': nonce, - 'integrity': integrity - }) - # response.headers['Content-Security-Policy'] = "script-src blob: 'self' 'unsafe-inline' 'unsafe-eval' https://*; worker-src blob: 'self' 'unsafe-inline' 'unsafe-eval' https://*;connect-src 'self' https://* wss://*;frame-src 'self' blob: https://*;" + response = request.render("applepay_fast_checkout.apple_pay_iframe", {'hyperpay_src': f"{url}/v1/paymentWidgets.js", 'merchant_id': acquirer_id.applepay_entity_id, 'nonce': nonce, 'integrity': integrity}) + response.headers['Content-Security-Policy'] = "script-src blob: 'self' 'unsafe-inline' 'unsafe-eval' https://*; worker-src blob: 'self' 'unsafe-inline' 'unsafe-eval' https://*;connect-src 'self' https://* wss://*;frame-src 'self' blob: https://*;" return response diff --git a/odex25_donation/applepay_fast_checkout/views/applepay_iframe.xml b/odex25_donation/applepay_fast_checkout/views/applepay_iframe.xml index 3e0d7d694..cce1316f6 100644 --- a/odex25_donation/applepay_fast_checkout/views/applepay_iframe.xml +++ b/odex25_donation/applepay_fast_checkout/views/applepay_iframe.xml @@ -8,16 +8,16 @@ t-attf-content=" style-src 'self' https://*.oppwa.com 'unsafe-inline'; frame-src 'self' https://*.oppwa.com https://applepay.cdn-apple.com; - script-src 'self' https://*.oppwa.com https://applepay.cdn-apple.com 'nonce-{{script_nonce}}'; + script-src 'self' https://*.oppwa.com https://applepay.cdn-apple.com 'nonce-{{nonce}}'; connect-src 'self' https://*.oppwa.com; img-src 'self' https://*.oppwa.com;" /> - diff --git a/odex25_donation/payment_hyperpay/static/src/js/payment_hyperpay.js b/odex25_donation/payment_hyperpay/static/src/js/payment_hyperpay.js index fe9f94021..62b3ccf9b 100644 --- a/odex25_donation/payment_hyperpay/static/src/js/payment_hyperpay.js +++ b/odex25_donation/payment_hyperpay/static/src/js/payment_hyperpay.js @@ -117,7 +117,7 @@ odoo.define("payment_hyperpay.payment_hyperpay", function (require) { $modal_html.appendTo($("body")).modal({ keyboard: false, backdrop: "static" }); var style_css = ''; var script = `` - var js_script = `` + var js_script = '' var shopperResultUrlTag = '
diff --git a/odex25_donation/payment_hyperpay/static/src/js/payment_hyperpay.js b/odex25_donation/payment_hyperpay/static/src/js/payment_hyperpay.js index 62b3ccf9b..3cd480a1c 100644 --- a/odex25_donation/payment_hyperpay/static/src/js/payment_hyperpay.js +++ b/odex25_donation/payment_hyperpay/static/src/js/payment_hyperpay.js @@ -117,7 +117,7 @@ odoo.define("payment_hyperpay.payment_hyperpay", function (require) { $modal_html.appendTo($("body")).modal({ keyboard: false, backdrop: "static" }); var style_css = ''; var script = `` - var js_script = '' + var js_script = '' var shopperResultUrlTag = ' Date: Tue, 14 Oct 2025 18:22:12 +0300 Subject: [PATCH 5/5] Revert "[IMP] payment_applepay, payment_hyperpay: implement PCI DSS v4.0 requirements" This reverts commit 5d768c745fc3b2dbd75d3e00182325b59d9561cc. --- .../controllers/main.py | 10 +++----- .../views/applepay_iframe.xml | 12 ++------- .../payment_hyperpay/controllers/main.py | 13 +++------- .../static/src/js/payment_hyperpay.js | 25 ++++++------------- 4 files changed, 16 insertions(+), 44 deletions(-) diff --git a/odex25_donation/applepay_fast_checkout/controllers/main.py b/odex25_donation/applepay_fast_checkout/controllers/main.py index 33d4f50d1..6e5dc3850 100644 --- a/odex25_donation/applepay_fast_checkout/controllers/main.py +++ b/odex25_donation/applepay_fast_checkout/controllers/main.py @@ -1,24 +1,20 @@ import json -import secrets -import requests from odoo.http import route, request, Controller + class ApplePayFastCheckout(Controller): @route('/applepay', type='http', auth='public', website=True, csrf=False) def apple_pay_iframe(self, **kwargs): - nonce = secrets.token_urlsafe(16) acquirer_id = request.env['payment.acquirer'].sudo().search([('provider', '=', 'applepay')], limit=1) if acquirer_id.state == 'test': url = "https://eu-test.oppwa.com/v1/paymentWidgets.js" else: - url = "https://eu-prod.oppwa.com/v1/paymentWidgets.js" + url = "https://oppwa.com/v1/paymentWidgets.js" - integrity = requests.get(f'{url}/v1/fastcheckout/integrity').json().get('integrity', '') - - response = request.render("applepay_fast_checkout.apple_pay_iframe", {'hyperpay_src': url, 'merchant_id': acquirer_id.applepay_entity_id, 'nonce': nonce, 'integrity': integrity}) + response = request.render("applepay_fast_checkout.apple_pay_iframe", {'hyperpay_src': url, 'merchant_id': acquirer_id.applepay_entity_id}) response.headers['Content-Security-Policy'] = "script-src blob: 'self' 'unsafe-inline' 'unsafe-eval' https://*; worker-src blob: 'self' 'unsafe-inline' 'unsafe-eval' https://*;connect-src 'self' https://* wss://*;frame-src 'self' blob: https://*;" return response diff --git a/odex25_donation/applepay_fast_checkout/views/applepay_iframe.xml b/odex25_donation/applepay_fast_checkout/views/applepay_iframe.xml index 7f83bb306..d508d8ca7 100644 --- a/odex25_donation/applepay_fast_checkout/views/applepay_iframe.xml +++ b/odex25_donation/applepay_fast_checkout/views/applepay_iframe.xml @@ -4,20 +4,12 @@