[FIX] payment_authorize: support references longer than 20 characters

We can have payment.transaction references of >20 characters. This
happens automatically if you have long sale.{order,subscription}
sequences (especially through website_payment because it adds multiple
suffixes, e.g. SO2020/1234567 could turn into
SO2020/1234567-12-1-1-1). We POST the full reference via the
x_invoice_num variable. Unfortunately Authorize specifies a maximum
length of 20 for this field [1]. So when Authorize POSTs back to
/payment/authorize/return it only specifies the first 20 characters in
x_invoice_num. E.g. when POSTing

{
...
'x_invoice_num': 'SO2020/1234567-12-1-1-1',
...
}

we receive back in /payment/authorize/return:

{
...
'x_invoice_num': 'SO2020/1234567-12-1-',
...
}

This causes _authorize_form_get_tx_from_data() to not find the
transaction which results in a ValidationError.

To fix this also pass the reference in the x_description field. It has
a more generous 255 character limit [1]. Then search using both.

We can't get rid of x_invoice_num entirely because we cannot assume
the payment_authorize.authorize_form will be updated (even more so
because it's a noupdate="1" template). By still using it in
_authorize_form_get_tx_from_data() we ensure that everything keeps
working regardless of whether or not x_description is included in the
template.

[1] p39 in https://www.authorize.net/content/dam/anet-redesign/documents/AIM_guide.pdf

opw-2373433

closes odoo/odoo#61446

X-original-commit: 3a220d3ad2999a21d54924940574ba96a9c07154
Signed-off-by: jorenvo <jorenvo@users.noreply.github.com>
Signed-off-by: Nicolas Martinelli (nim) <nim@odoo.com>

2 files changed, 4 insertions, 3 deletions

diff --git a/addons/payment_authorize/models/payment.py b/addons/payment_authorize/models/payment.py
index dcd17f0f5d6..c414625397f 100644
--- a/addons/payment_authorize/models/payment.py
+++ b/addons/payment_authorize/models/payment.py
@@ -171,14 +171,14 @@ class TxAuthorize(models.Model):
     def _authorize_form_get_tx_from_data(self, data):
         """ Given a data dict coming from authorize, verify it and find the related
         transaction record. """
-        reference, trans_id, fingerprint = data.get('x_invoice_num'), data.get('x_trans_id'), data.get('x_SHA2_Hash') or data.get('x_MD5_Hash')
+        reference, description, trans_id, fingerprint = data.get('x_invoice_num'), data.get('x_description'), data.get('x_trans_id'), data.get('x_SHA2_Hash') or data.get('x_MD5_Hash')
         if not reference or not trans_id or not fingerprint:
             error_msg = _('Authorize: received data with missing reference (%s) or trans_id (%s) or fingerprint (%s)') % (reference, trans_id, fingerprint)
             _logger.info(error_msg)
             raise ValidationError(error_msg)
-        tx = self.search([('reference', '=', reference)])
+        tx = self.search(['|', ('reference', '=', reference), ('reference', '=', description)])
         if not tx or len(tx) > 1:
-            error_msg = 'Authorize: received data for reference %s' % (reference)
+            error_msg = 'Authorize: received data for x_invoice_num %s and x_description %s' % (reference, description)
             if not tx:
                 error_msg += '; no order found'
             else:
diff --git a/addons/payment_authorize/views/payment_authorize_templates.xml b/addons/payment_authorize/views/payment_authorize_templates.xml
index 66f63bcb18c..e1bad342130 100644
--- a/addons/payment_authorize/views/payment_authorize_templates.xml
+++ b/addons/payment_authorize/views/payment_authorize_templates.xml
@@ -19,6 +19,7 @@
                 <input type="hidden" name='x_cancel_url' t-att-value="x_cancel_url"/>
                 <!--Order Information -->
                 <input type="hidden" name='x_invoice_num' t-att-value='reference'/>
+                <input type="hidden" name='x_description' t-att-value='reference'/>
                 <input type="hidden" name='x_currency_code' t-att-value='x_currency_code'/>
                 <!-- Billing Information-->
                 <input type="hidden" name='x_first_name' t-att-value="billing_first_name"/>