Wednesday, April 17, 2024
4 changes · saas-17.1
Resolved issues and error corrections
Saving a payment method from the customer portal now respects provider amount limits, including currency-specific checks. This prevents customers from selecting payment options that should not be available for the intended amount.
Original PR description
Setting a payment method currently bypasses the maximum_amount on the payment.provider. This provides methods that can be overwritten and handles a possible passed currency_id that is required by _get_compatible_providers() to restrict on amount. opw-3858340 - https://github.com/odoo/enterprise/pull/60294
Customers can no longer set up or use a payment method for a subscription when the payment provider's maximum allowed amount is too low. This prevents subscriptions from being charged through providers that should have been blocked by configured payment limits.
Original PR description
Previously, it was easy to bypass the maximum_amount field on payment.provider by going to a subscription and clicking "Set Payment Method". The subscription would then be charged with the token,…
Previously, it was easy to bypass the maximum_amount field on payment.provider by going to a subscription and clicking "Set Payment Method". The subscription would then be charged with the token, regardless of the maximum_amount set on the payment.provider.
This filters out ineligible acquirers through
_get_compatible_providers() so it's not possible to use them for new payment methods. The existing override wasn't working because sale_order_id was a string and sale.order('1').exists() always returns False. Casting sale_order_id to a string was added in a small /my/payment_method route override.
Filtering out already existing payment methods is harder because the sale order isn't available in _get_available_tokens(). Instead we raise a UserError when a user assigns an ineligible payment method. This is handled well in the frontend.
This focuses only on customer-facing flows. The maximum_amount field isn't checked either on e.g. account.payment but that's only accessible to internal users. Other customer-facing flows aren't affected because typically _get_available_tokens() is called with eligible payment providers as its first parameter.
Attempted alternative approaches:
- odoo/odoo#161021, odoo/enterprise#60294
- odoo/enterprise#60382
opw-3858340Subscription payments now check the payment provider's maximum allowed amount before charging a saved payment method. If the amount is too high, the payment is stopped and sales teams see a clear error on the subscription, helping prevent unintended charges above provider limits.
Original PR description
Previously, it was easy to bypass the maximum_amount field on payment.provider by going to a subscription and clicking "Set Payment Method". The subscription would then be charged with the token,…
Previously, it was easy to bypass the maximum_amount field on payment.provider by going to a subscription and clicking "Set Payment Method". The subscription would then be charged with the token, regardless of the maximum_amount set on the payment.provider. This verifies if the amount is low enough before sending a request to the payment provider. If not, the transaction is set to error. This error message ends up on the subscription's chatter, informing salespeople what went wrong. It's not possible to filter out errored transactions in the _send_payment_request() base method so we filter them out explicitly here. This focuses only on customer-facing flows. The maximum_amount field isn't checked either on e.g. account.payment but that's only accessible to internal users. Other customer-facing flows aren't affected because typically _get_available_tokens() is called with eligible payment providers as its first parameter. Filtering out ineligible payment providers was attempted [1][2] but is more complicated. Additionally, that approach was incomplete because it would also need to filter out already existing tokens, making it even more complex. [1] odoo/odoo#161021 [2] odoo/enterprise#60294 opw-3858340
This fixes a loophole where customers could choose payment providers that should have been blocked by maximum payment amount limits when updating a subscription payment method. The change helps ensure subscription payments follow the same provider restrictions as other payment flows.
Original PR description
Previously, it was easy to bypass the maximum_amount field on payment.provider by going to a subscription and clicking "Set Payment Method". This sets all the parameters needed to restrict payment providers to the /my/payment_method route. It also extracts _get_token_management_url_params() so it can be reused in the test. opw-3858340 - https://github.com/odoo/odoo/pull/161021