[FIX] payment_adyen, payment_authorize, payment_buckaroo, payment_paypal, payment_sips: Disable csrf on callbacks

Inspired from 2099f15d67564ab153d48993cca0f80aee04bb09

opw:653341

6 files changed, 10 insertions, 10 deletions

diff --git a/addons/payment_adyen/controllers/main.py b/addons/payment_adyen/controllers/main.py
index 3ae1c8145c1..de05f72d66b 100644
--- a/addons/payment_adyen/controllers/main.py
+++ b/addons/payment_adyen/controllers/main.py
@@ -16,7 +16,7 @@ class AdyenController(http.Controller):
 
     @http.route([
         '/payment/adyen/return',
-    ], type='http', auth='none')
+    ], type='http', auth='none', csrf=False)
     def adyen_return(self, **post):
         _logger.info('Beginning Adyen form_feedback with post data %s', pprint.pformat(post))  # debug
         if post.get('authResult') not in ['CANCELLED']:
@@ -29,7 +29,7 @@ class AdyenController(http.Controller):
 
     @http.route([
         '/payment/adyen/notification',
-    ], type='http', auth='none', methods=['POST'])
+    ], type='http', auth='none', methods=['POST'], csrf=False)
     def adyen_notification(self, **post):
         tx_id = post.get('merchantReference') and request.registry['payment.transaction'].search(request.cr, SUPERUSER_ID, [('reference', 'in', [post.get('merchantReference')])], limit=1, context=request.context)
         if post.get('eventCode') in ['AUTHORISATION'] and tx_id:
diff --git a/addons/payment_authorize/controllers/main.py b/addons/payment_authorize/controllers/main.py
index 1279c23ce26..93b3d105f9a 100644
--- a/addons/payment_authorize/controllers/main.py
+++ b/addons/payment_authorize/controllers/main.py
@@ -16,7 +16,7 @@ class AuthorizeController(http.Controller):
     @http.route([
         '/payment/authorize/return/',
         '/payment/authorize/cancel/',
-    ], type='http', auth='public')
+    ], type='http', auth='public', csrf=False)
     def authorize_form_feedback(self, **post):
         _logger.info('Authorize: entering form_feedback with post data %s', pprint.pformat(post))
         return_url = '/'
diff --git a/addons/payment_buckaroo/controllers/main.py b/addons/payment_buckaroo/controllers/main.py
index dec20f3de04..d6797493936 100644
--- a/addons/payment_buckaroo/controllers/main.py
+++ b/addons/payment_buckaroo/controllers/main.py
@@ -21,7 +21,7 @@ class BuckarooController(http.Controller):
         '/payment/buckaroo/cancel',
         '/payment/buckaroo/error',
         '/payment/buckaroo/reject',
-    ], type='http', auth='none')
+    ], type='http', auth='none', csrf=False)
     def buckaroo_return(self, **post):
         """ Buckaroo."""
         _logger.info('Buckaroo: entering form_feedback with post data %s', pprint.pformat(post))  # debug
diff --git a/addons/payment_ogone/controllers/main.py b/addons/payment_ogone/controllers/main.py
index 1a7b095e6ff..3137f619d2d 100644
--- a/addons/payment_ogone/controllers/main.py
+++ b/addons/payment_ogone/controllers/main.py
@@ -29,7 +29,7 @@ class OgoneController(http.Controller):
         request.registry['payment.transaction'].form_feedback(cr, uid, post, 'ogone', context=context)
         return werkzeug.utils.redirect(post.pop('return_url', '/'))
 
-    @http.route(['/payment/ogone/s2s/create_json'], type='json', auth='public')
+    @http.route(['/payment/ogone/s2s/create_json'], type='json', auth='public', csrf=False)
     def ogone_s2s_create_json(self, **kwargs):
         data = kwargs
         acquirer_id = int(data.get('acquirer_id'))
@@ -37,14 +37,14 @@ class OgoneController(http.Controller):
         new_id = acquirer.s2s_process(data)
         return new_id
 
-    @http.route(['/payment/ogone/s2s/create'], type='http', auth='public', methods=["POST"])
+    @http.route(['/payment/ogone/s2s/create'], type='http', auth='public', methods=["POST"], csrf=False)
     def ogone_s2s_create(self, **post):
         acquirer_id = int(post.get('acquirer_id'))
         acquirer = request.env['payment.acquirer'].browse(acquirer_id)
         acquirer.s2s_process(post)
         return werkzeug.utils.redirect(post.get('return_url', '/'))
 
-    @http.route(['/payment/ogone/s2s/feedback'], auth='none')
+    @http.route(['/payment/ogone/s2s/feedback'], auth='none', csrf=False)
     def feedback(self, **kwargs):
         cr, uid, context = request.cr, SUPERUSER_ID, request.context
         payment = request.registry.get('payment.transaction')
diff --git a/addons/payment_paypal/controllers/main.py b/addons/payment_paypal/controllers/main.py
index 491a6de7adb..0048c3ffb26 100644
--- a/addons/payment_paypal/controllers/main.py
+++ b/addons/payment_paypal/controllers/main.py
@@ -73,7 +73,7 @@ class PaypalController(http.Controller):
         self.paypal_validate_data(**post)
         return werkzeug.utils.redirect(return_url)
 
-    @http.route('/payment/paypal/cancel', type='http', auth="none")
+    @http.route('/payment/paypal/cancel', type='http', auth="none", csrf=False)
     def paypal_cancel(self, **post):
         """ When the user cancels its Paypal payment: GET on this route """
         cr, uid, context = request.cr, SUPERUSER_ID, request.context
diff --git a/addons/payment_sips/controllers/main.py b/addons/payment_sips/controllers/main.py
index 4cc2a858bfa..0bf4a5f52b3 100644
--- a/addons/payment_sips/controllers/main.py
+++ b/addons/payment_sips/controllers/main.py
@@ -42,14 +42,14 @@ class SipsController(http.Controller):
 
     @http.route([
         '/payment/sips/ipn/'],
-        type='http', auth='none', methods=['POST'])
+        type='http', auth='none', methods=['POST'], csrf=False)
     def sips_ipn(self, **post):
         """ Sips IPN. """
         self.sips_validate_data(**post)
         return ''
 
     @http.route([
-        '/payment/sips/dpn'], type='http', auth="none", methods=['POST'])
+        '/payment/sips/dpn'], type='http', auth="none", methods=['POST'], csrf=False)
     def sips_dpn(self, **post):
         """ Sips DPN """
         return_url = self._get_return_url(**post)