Changeset 9508

Timestamp:

2 Nov 2012, 10:50:58 (12 years ago)

Author:

Henrik Bettermann

Message:

Add more security.

Location:

main/waeup.aaue/trunk/src/waeup/aaue/etranzact

Files:

• browser.py (modified) (2 diffs)
• tests.py (modified) (1 diff)

main/waeup.aaue/trunk/src/waeup/aaue/etranzact/browser.py

@@ -45 +45 @@
 
     def update(self, PAYEE_ID=None):
+        if PAYEE_ID == None:
+            self.output = '-1'
+            return
         real_ip = self.request.get('HTTP_X_FORWARDED_FOR', None)
         # We can forego the logging once eTranzact payments run smoothly
@@ -60 +63 @@
         # RFC 2616 HTTP guidelines we may try to fetch the id from the QUERY_STRING
         # value of the request.
-
         #if PAYEE_ID is None:
         #    try:

main/waeup.aaue/trunk/src/waeup/aaue/etranzact/tests.py

@@ -85 +85 @@
             'FEE_AMOUNT=1234.0&'
             'TRANSACTION_STATUS=unpaid' % self.p_id)
+        self.browser.open('http://localhost/app/feerequest?NONSENSE=nonsense')
+        self.assertEqual(self.browser.contents, '-1')
 
     @external_test