Changeset 3874 for WAeUP_SRP

Timestamp:

26 Jan 2009, 08:52:01 (16 years ago)

Author:

Henrik Bettermann

Message:

avoid manipulation of the callback URL

I have to implement further improvements. The referer should be either interswitchng.com or waeup.org

File:

• WAeUP_SRP/trunk/skins/waeup_epayment/interswitch_cb.py (modified) (3 diffs)

WAeUP_SRP/trunk/skins/waeup_epayment/interswitch_cb.py

@@ -41 +41 @@
     logger.info('%s:%s illegal access, real_x_ip = %s' % (member_id,student_id,real_ip))
     return context.REQUEST.RESPONSE.redirect("%s/srp_anonymous_view" % context.portal_url())
+
+referer = request.get('HTTP_REFERER','none')
+real_ip = request.get('HTTP_X_REAL_IP',"none")  
+logger.info('%s, callback referer = %s, IP = %s' % (student_id,referer,real_ip))
+
+if referer == "":
+    logger.info('%s, no callback referrer, callback rejected, IP = %s' % (student_id,real_ip))
+    return request.RESPONSE.redirect("%s/waeup_document_view" % context.absolute_url())
 
 student = getattr(students,student_id)
@@ -91 +99 @@
 
 if  resp == '00':
-
     if pay_doc.category == 'schoolfee':  
         if context.getStudentReviewState() == "school_fee_paid":
@@ -132 +139 @@
 
     logger.info('%s received valid callback' % student_id)
-    #referer = request.get('HTTP_REFERER','none')
-    #logger.info('%s valid callback referer = %s' % (student_id,referer))
-    #real_ip = request.get('HTTP_X_REAL_IP',"none")
-    #logger.info('%s valid callback real_ip = %s' % (student_id,real_ip))
 
 else: