Odoo Changelog — 2024-01-15

Monday, January 15, 2024

1 change · 17.0

Bug Fixes(1)

Resolved issues and error corrections

[FW][FIX] iot: worldline multiple requests fixed

Enterprise17.0iotpos_iotSECURITY

Fixed critical issues when multiple point-of-sale locations or browser tabs use the same Worldline payment terminal simultaneously. The system was vulnerable to crashes and could accidentally cancel transactions from the wrong location. This update ensures each payment request is properly tracked and isolated, preventing cross-location interference and system crashes.

Original PR description

Currently, if you have 2 browser tabs or 2 different PoS using the same Worldline terminal, there was a way to do some damage if requests were started at the same time 1) Since we call C++ code…

Currently, if you have 2 browser tabs or 2 different PoS using the same Worldline terminal, there was a way to do some damage if requests were started at the same time
1) Since we call C++ code through a thread without a mutex, it was possible to get a race condition and provoke a segmentation fault
2) Even if there was no race condition, we were not specifying to who the driver is replying all the time. So a cancel request on the 1st PoS could cancel an active transaction on the 2nd PoS.

This PR fixes both issues by specifying the owner of the request and the cid in every single response sent from the driver to the frontend.
I am also adding the cid to the data sent in a cancellation request as otherwise we don't know which transaction line we're cancelling.
It replaces the threads by a queue to avoid race conditions in the future and respect the condition that all the Driver class logic must be executed in the "run" method for safe execution.
It also fixes the Last Transaction Status popup which could accidentally "catch" the response from a transaction since it doesn't care about the cid.
This PR also makes the popup consistent with the response (using error popup for a response resulting in an error).

task-3676153

Forward-Port-Of: odoo/enterprise#54157
Forward-Port-Of: odoo/enterprise#53951

#payment#worldline#stability#multi-location#crash-prevention

Currently, if you have 2 browser tabs or 2 different PoS using the same Worldline terminal, there was a way to do some damage if requests were started at the same time 1) Since we call C++ code through a thread without a mutex, it was possible to get a race condition and provoke a segmentation fault 2) Even if there was no race condition, we were not specifying to who the driver is replying all the time. So a cancel request on the 1st PoS could cancel an active transaction on the 2nd PoS. This PR fixes both issues by specifying the owner of the request and the cid in every single response sent from the driver to the frontend. I am also adding the cid to the data sent in a cancellation request as otherwise we don't know which transaction line we're cancelling. It replaces the threads by a queue to avoid race conditions in the future and respect the condition that all the Driver class logic must be executed in the "run" method for safe execution. It also fixes the Last Transaction Status popup which could accidentally "catch" the response from a transaction since it doesn't care about the cid. This PR also makes the popup consistent with the response (using error popup for a response resulting in an error). task-3676153 Forward-Port-Of: odoo/enterprise#54157 Forward-Port-Of: odoo/enterprise#53951