Skip to content

Fix amount tampering, broken IPN URL and invoice status handling (19.0) #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SatoDri wants to merge 5 commits into
base: 19.0
Choose a base branch
from
Open

Fix amount tampering, broken IPN URL and invoice status handling (19.0) #19

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9f3f702
Declare ecdsa as the module Python dependency
SatoDri Jul 19, 2026
023e406
Remove dead payment.provider create() override
SatoDri Jul 19, 2026
303bfce
Build the BTCPay invoice server-side and validate the settled amount
SatoDri Jul 19, 2026
cab44f0
Make sure changes from 18.0 are also here:
ndeet Aug 7, 2026
2a470af
Merge pull request #2 from ndeet/satodri-19-fixes
SatoDri Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions payment_btcpayserver/__manifest__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
'author': 'BTCPay Server team and contributors',
'website': 'https://github.com/btcpayserver/odoo',
'category': 'Accounting/Payment Providers',
'version': '19.0.1.0',
'version': '19.0.1.1',
'license': 'GPL-3',
'currency': 'USD',
'application': False,
Expand All @@ -39,8 +39,10 @@
'data/payment_provider_data.xml',
],
'images': ['static/description/BTCPay-Odoo-17-featured.png'],
# The BTCPay client (legacy BitPay API) is vendored in models/libs and
# only requires 'ecdsa' (plus 'requests', shipped with Odoo).
'external_dependencies': {
'python': ['btcpay-python']
'python': ['ecdsa']
},
'post_init_hook': 'post_init_hook',
'uninstall_hook': 'uninstall_hook',
Expand Down
303 changes: 243 additions & 60 deletions payment_btcpayserver/controllers/main.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,7 @@
# ******************************************************************************

import json
import pprint

import werkzeug
from werkzeug import urls

from odoo import _, http
Expand All @@ -41,85 +39,270 @@ class BTCPayController(http.Controller):
_notify_url = '/payment/btcpay/ipn'
_return_url = '/payment/btcpay/return'

@http.route(_checkout_url, type='http', auth='public', csrf=False, website=True)
def checkout(self, **data):

_logger.info("CHECKOUT: received data:\n%s", pprint.pformat(data))
@staticmethod
def _btcpay_client(provider):
return BTCPayClient(
host=provider.btcpay_location,
pem=provider.btcpay_privateKey,
tokens={provider.btcpay_facade: provider.btcpay_token},
)

# Look up the transaction by reference
reference = data.get('reference')
tx_sudo = request.env['payment.transaction'].sudo().search([
@staticmethod
def _find_transaction(reference):
return request.env['payment.transaction'].sudo().search([
('reference', '=', reference),
('provider_code', '=', 'btcpayserver'),
], limit=1)

@staticmethod
def _lock_transaction(tx_sudo):
"""Lock a transaction until the current database transaction ends.

Checkout and IPN requests can arrive concurrently. Serializing them on
the payment transaction prevents two checkout requests from creating
separate invoices and makes an IPN re-check the invoice ID after a
checkout replaces an expired invoice.
"""
tx_sudo.ensure_one()
tx_sudo.flush_recordset()
tx_sudo.env.cr.execute(
"SELECT id FROM payment_transaction WHERE id = %s FOR UPDATE",
[tx_sudo.id],
)
tx_sudo.invalidate_recordset([
'state', 'btcpay_invoiceId', 'provider_reference',
])

@staticmethod
def _ensure_invoice_id_is_unique(tx_sudo, invoice_id):
"""Reject an invoice ID already linked to another transaction."""
other_tx = tx_sudo.env['payment.transaction'].sudo().search([
('id', '!=', tx_sudo.id),
('provider_code', '=', 'btcpayserver'),
'|',
('btcpay_invoiceId', '=', invoice_id),
('provider_reference', '=', invoice_id),
], limit=1)
if other_tx:
raise ValidationError(_(
"BTCPay: The invoice is already linked to another transaction."
))

@classmethod
def _validate_invoice_binding(
cls, tx_sudo, incoming_invoice_id, incoming_order_id, fetched_invoice):
"""Bind the untrusted IPN payload to one authenticated invoice and transaction."""
if not isinstance(fetched_invoice, dict):
raise ValidationError(_("BTCPay: Received an invalid invoice response."))

fetched_invoice_id = fetched_invoice.get('id')
fetched_order_id = fetched_invoice.get('orderId')
if not (
incoming_invoice_id
and incoming_invoice_id == fetched_invoice_id
and incoming_invoice_id == tx_sudo.btcpay_invoiceId
and incoming_invoice_id == tx_sudo.provider_reference
):
raise ValidationError(_(
"BTCPay: The notification invoice does not match the transaction."
))
if not (
incoming_order_id
and incoming_order_id == fetched_order_id
and incoming_order_id == tx_sudo.reference
):
raise ValidationError(_(
"BTCPay: The notification order does not match the transaction."
))
cls._ensure_invoice_id_is_unique(tx_sudo, incoming_invoice_id)

@classmethod
def _find_transaction_by_invoice_id(cls, invoice_id):
"""Find exactly one BTCPay transaction from its stored invoice ID."""
if not isinstance(invoice_id, str) or not invoice_id:
raise ValidationError(_("BTCPay: Missing invoice ID in notification data."))

txs_sudo = request.env['payment.transaction'].sudo().search([
('provider_code', '=', 'btcpayserver'),
('btcpay_invoiceId', '=', invoice_id),
], limit=2)
if len(txs_sudo) != 1:
raise ValidationError(_(
"BTCPay: No unique transaction found matching the invoice ID."
))
return txs_sudo

@staticmethod
def _validate_invoice_amount(tx_sudo, invoice):
"""Reject reuse of an invoice with a different amount or currency."""
try:
amount = float(invoice.get('price'))
except (AttributeError, TypeError, ValueError):
amount = None
if (
amount is None
or invoice.get('currency') != tx_sudo.currency_id.name
or tx_sudo.currency_id.compare_amounts(amount, tx_sudo.amount) != 0
):
raise ValidationError(_(
"BTCPay: The existing invoice amount or currency does not match the transaction."
))

@classmethod
def _validate_existing_invoice(cls, tx_sudo, invoice_id, invoice):
"""Validate a stored invoice before redirecting the customer to it."""
cls._validate_invoice_binding(
tx_sudo, invoice_id, tx_sudo.reference, invoice,
)
if not isinstance(invoice.get('status'), str) or not invoice['status']:
raise ValidationError(_("BTCPay: The existing invoice response is incomplete."))

@classmethod
def _validate_created_invoice(cls, tx_sudo, invoice):
"""Validate a newly created invoice before storing its identity."""
if not isinstance(invoice, dict):
raise ValidationError(_("BTCPay: Received an invalid invoice response."))
invoice_id = invoice.get('id')
if (
not isinstance(invoice_id, str)
or not invoice_id
or not isinstance(invoice.get('url'), str)
or not invoice['url']
or invoice.get('orderId') not in (None, tx_sudo.reference)
):
raise ValidationError(_("BTCPay: The created invoice response is incomplete."))
cls._ensure_invoice_id_is_unique(tx_sudo, invoice_id)

@http.route(_checkout_url, type='http', auth='public', methods=['POST'],
csrf=False, website=True)
def checkout(self, **data):
""" Create the BTCPay invoice and redirect the buyer to it.

The redirect form only carries the transaction reference. The invoice
price, currency and buyer details are read from the transaction
server-side and are never taken from the (client-controlled) request
data, so a buyer cannot have an invoice created for a tampered amount.
"""
_logger.info("BTCPay: checkout request for transaction %s", data.get('reference'))
reference = data.get('reference')
tx_sudo = self._find_transaction(reference)
if not tx_sudo:
raise ValidationError(
_("BTCPay: No transaction found matching reference %s.", reference)
)
_("BTCPay: No transaction found matching reference %s.", reference))
self._lock_transaction(tx_sudo)
if tx_sudo.state != 'draft':
# Already processed (e.g. double submission): fall back to the
# generic payment status page.
return request.redirect('/payment/status')

provider = tx_sudo.provider_id
notification_url = str(data.get('notify_url')).replace("http://", "https://")
base_url = request.env['ir.config_parameter'].sudo().get_param('web.base.url')
redirect_url = urls.url_join(base_url, self._return_url)
client = BTCPayClient(host=provider.btcpay_location, pem=provider.btcpay_privateKey, tokens={provider.btcpay_facade: provider.btcpay_token})
invoice = client.create_invoice(
{"price": data.get('amount'),
"currency": data.get('currency_id'),
"orderId": data.get('reference'),
"token": provider.btcpay_token,
"redirectURL": redirect_url,
"notificationURL": notification_url,
"extendedNotifications": True,
"buyer": {"email": data.get('email') or 'noemailavailable@example.com',
"name": data.get('name'),
"address1": data.get('street'),
"locality": data.get('city'),
"postalCode": data.get('zip'),
"country": data.get('country'),
"notify": False}})
_logger.info('Invoice %s \n NOTIFY URL: %s', invoice, notification_url)
return werkzeug.utils.redirect(invoice['url'])

@http.route(_notify_url, type='jsonrpc', auth='public', csrf=False)
base_url = provider.get_base_url()
client = self._btcpay_client(provider)

# A browser retry must not create a second payable invoice. Reuse the
# stored invoice while it remains payable. If it expired, the new ID is
# stored before the lock is released, so late notifications for the old
# invoice can no longer select this transaction.
if tx_sudo.btcpay_invoiceId:
existing_invoice = client.get_invoice(tx_sudo.btcpay_invoiceId)
self._validate_existing_invoice(
tx_sudo, tx_sudo.btcpay_invoiceId, existing_invoice,
)
if existing_invoice['status'].lower() != 'expired':
self._validate_invoice_amount(tx_sudo, existing_invoice)
if (
not isinstance(existing_invoice.get('url'), str)
or not existing_invoice['url']
):
raise ValidationError(_(
"BTCPay: The existing invoice response is incomplete."
))
_logger.info(
"BTCPay: reusing invoice %s for transaction %s",
tx_sudo.btcpay_invoiceId, tx_sudo.reference,
)
return request.redirect(existing_invoice['url'], local=False)

invoice = client.create_invoice({
"price": tx_sudo.amount,
"currency": tx_sudo.currency_id.name,
"orderId": tx_sudo.reference,
"token": provider.btcpay_token,
"redirectURL": urls.url_join(base_url, self._return_url),
"notificationURL": urls.url_join(base_url, self._notify_url),
"extendedNotifications": True,
"buyer": {
"email": tx_sudo.partner_email or 'noemailavailable@example.com',
"name": tx_sudo.partner_name,
"address1": tx_sudo.partner_address,
"locality": tx_sudo.partner_city,
"postalCode": tx_sudo.partner_zip,
"country": tx_sudo.partner_country_id.code,
"notify": False,
},
})
self._validate_created_invoice(tx_sudo, invoice)
tx_sudo.write({
'btcpay_invoiceId': invoice['id'],
'provider_reference': invoice['id'],
})
_logger.info("BTCPay: created invoice %s for transaction %s",
invoice['id'], tx_sudo.reference)
return request.redirect(invoice['url'], local=False)

@http.route(_notify_url, type='jsonrpc', auth='public', methods=['POST'], csrf=False)
def btcpay_ipn(self, **post):
""" BTCPay IPN. """
_logger.info('BTCPAY IPN RECEIVED...')
data = json.loads(request.httprequest.data)
_logger.info("%s", pprint.pformat(data))
_logger.info('BTCPay: IPN received')
try:
reference = data['data']['orderId']
invoice_id = data['data']['id']
data = json.loads(request.httprequest.data)
except (json.JSONDecodeError, TypeError, UnicodeDecodeError):
_logger.warning("BTCPay: received malformed JSON notification data")
return ''

# Look up the transaction by reference
tx_sudo = request.env['payment.transaction'].sudo().search([
('reference', '=', reference),
('provider_code', '=', 'btcpayserver'),
], limit=1)
if not tx_sudo:
_logger.warning("No transaction found matching reference %s.", reference)
return ''
try:
ipn_data = data.get('data') if isinstance(data, dict) else None
if not isinstance(ipn_data, dict):
raise ValidationError(_("BTCPay: Invalid notification data."))
incoming_invoice_id = ipn_data.get('id')
incoming_order_id = ipn_data.get('orderId')

provider = tx_sudo.provider_id
client = BTCPayClient(host=provider.btcpay_location, pem=provider.btcpay_privateKey,
tokens={provider.btcpay_facade: provider.btcpay_token})
# Never use the untrusted order ID to select a transaction. The
# stored invoice ID is the lookup key.
tx_sudo = self._find_transaction_by_invoice_id(incoming_invoice_id)
client = self._btcpay_client(tx_sudo.provider_id)

fetched_invoice = client.get_invoice(invoice_id)
_logger.info('fetched_invoice = %s', pprint.pformat(fetched_invoice))
# Fetching through the authenticated API establishes the invoice's
# current state. Lock afterwards and re-check the stored ID so a
# concurrent checkout cannot replace it between lookup and use.
fetched_invoice = client.get_invoice(incoming_invoice_id)
self._lock_transaction(tx_sudo)
self._validate_invoice_binding(
tx_sudo, incoming_invoice_id, incoming_order_id, fetched_invoice,
)
_logger.info(
"BTCPay: verified invoice %s with status %s for transaction %s",
fetched_invoice.get('id'), fetched_invoice.get('status'), tx_sudo.reference,
)

payment_data = {
"reference": fetched_invoice['orderId'],
"status": fetched_invoice['status'],
"invoiceID": fetched_invoice['id'],
"txid": fetched_invoice['url'],
"reference": tx_sudo.reference,
"status": fetched_invoice.get('status'),
"invoiceID": incoming_invoice_id,
"txid": fetched_invoice.get('url'),
# Settled amount and currency, validated against the transaction
# by the payment framework before it is set done.
"amount": fetched_invoice.get('price'),
"currency": fetched_invoice.get('currency'),
}

# Use the new Odoo 19 _process() pipeline
tx_sudo._process('btcpayserver', payment_data)
except ValidationError:
_logger.exception("Unable to handle the notification data; skipping to acknowledge")
except ValidationError as error:
_logger.warning("BTCPay: rejected notification: %s", error)
return ''

@http.route(_return_url, type='http', auth="public", methods=['GET'], csrf=False, save_session=False)
@http.route(_return_url, type='http', auth="public", methods=['GET'],
csrf=False, save_session=False)
def btcpay_return_from_redirect(self, **data):
""" BTCPay return """
_logger.info("BTCPay: user returned to shop after payment")
Expand Down
10 changes: 2 additions & 8 deletions payment_btcpayserver/models/payment_provider.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
from odoo import _, api, fields, models
from odoo import api, fields, models
from .libs.client import BTCPayClient
from .libs import crypto

Expand All @@ -21,15 +21,9 @@ class PaymentProvider(models.Model):
btcpay_privateKey = fields.Text(string='Private Key', help='Private Key for BTCPay Client. Leave empty, will be autogenerated during pairing.')
btcpay_facade = fields.Char(string='Facade', help='Token facade type: merchant/pos/payroll. Keep merchant', default='merchant')

def create(self, values_list):
if self.code == 'btcpayserver':
values_list['btcpay_privateKey'] = crypto.generate_privkey()

return super(PaymentProvider, self).create(values_list)

@api.onchange('btcpay_pairingCode')
def _onchange_pairingCode(self):
if not self.btcpay_token and self.code == 'btcpayserver' and not self.btcpay_pairingCode == '':
if not self.btcpay_token and self.code == 'btcpayserver' and self.btcpay_pairingCode:
self.btcpay_privateKey = crypto.generate_privkey()
client = BTCPayClient(host=self.btcpay_location, pem=self.btcpay_privateKey)
token = client.pair_client(self.btcpay_pairingCode)
Expand Down
Loading