[IMP] payment, sale: access token for payment link wizard

When generating a link for a payment through the website_payment/pay
route, including the partner_id 'blindly' is somewhat of a security
issue since it means you could potentially create payments for any
partner of your choosing.

This commit instead introduces an access token mechanism where the
partner_id, amount and currency_id are used to generate a unique access
token that can be checked upon accessing the payment page. This token
is only checked if the partner_id field is set (otherwise this is just
an anonymous payment like any other).

2 files changed, 28 insertions, 2 deletions

diff --git a/addons/payment/wizards/payment_link_wizard.py b/addons/payment/wizards/payment_link_wizard.py
index 4d24315153c..fd068e896b3 100644
--- a/addons/payment/wizards/payment_link_wizard.py
+++ b/addons/payment/wizards/payment_link_wizard.py
@@ -1,8 +1,11 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
+import hashlib
+import hmac
 
 from odoo import api, fields, models, _
 from odoo.exceptions import ValidationError
+from odoo.tools import ustr, consteq
 
 
 class PaymentLinkWizard(models.TransientModel):
@@ -32,8 +35,9 @@ class PaymentLinkWizard(models.TransientModel):
     amount_max = fields.Monetary(currency_field='currency_id')
     currency_id = fields.Many2one('res.currency')
     partner_id = fields.Many2one('res.partner')
-    link = fields.Char(string='Payment Link')
+    link = fields.Char(string='Payment Link', compute='_compute_values')
     description = fields.Char('Payment Ref')
+    access_token = fields.Char(compute='_compute_values')
 
     @api.onchange('amount', 'description')
     def _onchange_amount(self):
@@ -41,5 +45,26 @@ class PaymentLinkWizard(models.TransientModel):
             raise ValidationError(_("Please set an amount smaller than %s.") % (self.amount_max))
         if self.amount <= 0:
             raise ValidationError(_("The value of the payment amount must be positive."))
+
+    @api.depends('amount', 'description', 'partner_id', 'currency_id')
+    def _compute_values(self):
+        secret = self.env['ir.config_parameter'].sudo().get_param('database.secret')
+        for payment_link in self:
+            token_str = '%s%s%s' % (payment_link.partner_id.id, payment_link.amount, payment_link.currency_id.id)
+            payment_link.access_token = hmac.new(secret.encode('utf-8'), token_str.encode('utf-8'), hashlib.sha256).hexdigest()
+        # must be called after token generation, obvsly - the link needs an up-to-date token
+        self._generate_link()
+
+    def _generate_link(self):
         base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
-        self.link = '%s/website_payment/pay?reference=%s&amount=%s&currency_id=%s&partner_id=%s' % (base_url, self.description, self.amount, self.currency_id.id, self.partner_id.id)
+        for payment_link in self:
+            payment_link.link = '%s/website_payment/pay?reference=%s&amount=%s&currency_id=%s&partner_id=%s&access_token=%s' % (base_url, payment_link.description, payment_link.amount, payment_link.currency_id.id, payment_link.partner_id.id, payment_link.access_token)
+
+    @api.model
+    def check_token(self, access_token, partner_id, amount, currency_id):
+        secret = self.env['ir.config_parameter'].sudo().get_param('database.secret')
+        token_str = '%s%s%s' % (partner_id, amount, currency_id)
+        correct_token = hmac.new(secret.encode('utf-8'), token_str.encode('utf-8'), hashlib.sha256).hexdigest()
+        if consteq(ustr(access_token), correct_token):
+            return True
+        return False
\ No newline at end of file
diff --git a/addons/payment/wizards/payment_link_wizard_views.xml b/addons/payment/wizards/payment_link_wizard_views.xml
index 3db3945eb10..500e9b0a181 100644
--- a/addons/payment/wizards/payment_link_wizard_views.xml
+++ b/addons/payment/wizards/payment_link_wizard_views.xml
@@ -13,6 +13,7 @@
                     <field name="description"/>
                     <field name="amount"/>
                     <field name="currency_id" invisible="1"/>
+                    <field name="access_token" invisible="1"/>
                 </group>
                 <group>
                     <field name="link" readonly="1" widget="CopyClipboardChar"/>