[MERGE] forward port branch saas-15 up to 21c84f15322

1 files changed, 12 insertions, 3 deletions

diff --git a/addons/payment_authorize/models/payment.py b/addons/payment_authorize/models/payment.py
index cd35782a506..e3251f7770a 100644
--- a/addons/payment_authorize/models/payment.py
+++ b/addons/payment_authorize/models/payment.py
@@ -6,6 +6,7 @@ from datetime import datetime
 import hashlib
 import hmac
 import logging
+import string
 import time
 
 from odoo import _, api, fields, models
@@ -53,8 +54,16 @@ class PaymentAcquirerAuthorize(models.Model):
             values['x_fp_sequence'],
             values['x_fp_timestamp'],
             values['x_amount'],
-            values['x_currency_code']])
-        return hmac.new(values['x_trans_key'].encode('utf-8'), data.encode('utf-8'), hashlib.md5).hexdigest()
+            values['x_currency_code']]).encode('utf-8')
+
+        # [BACKWARD COMPATIBILITY] Check that the merchant did update his transaction
+        # key to signature key (end of MD5 support from Authorize.net)
+        # The signature key is now '128-character hexadecimal format', while the
+        # transaction key was only 16-character.
+        if len(values['x_trans_key']) == 128:
+            return hmac.new(values['x_trans_key'].decode("hex").encode('utf-8'), data, hashlib.sha512).hexdigest().upper()
+        else:
+            return hmac.new(values['x_trans_key'].encode('utf-8'), data, hashlib.md5).hexdigest()
 
     @api.multi
     def authorize_form_generate_values(self, values):
@@ -181,7 +190,7 @@ class TxAuthorize(models.Model):
     def _authorize_form_get_tx_from_data(self, data):
         """ Given a data dict coming from authorize, verify it and find the related
         transaction record. """
-        reference, trans_id, fingerprint = data.get('x_invoice_num'), data.get('x_trans_id'), data.get('x_MD5_Hash')
+        reference, trans_id, fingerprint = data.get('x_invoice_num'), data.get('x_trans_id'), data.get('x_SHA2_Hash') or data.get('x_MD5_Hash')
         if not reference or not trans_id or not fingerprint:
             error_msg = _('Authorize: received data with missing reference (%s) or trans_id (%s) or fingerprint (%s)') % (reference, trans_id, fingerprint)
             _logger.info(error_msg)