search

PayMaya / PayMaya-Checkout-Magento-Plugin

PayMaya Checkout plugin (module) for Magento 2.x.
1 stars 2 forks source link

Bypass CSRF #1

Closed hmphu closed 5 years ago

hmphu commented 5 years ago

The paymaya callback was redirected to 404 page because of no form_key submitted from Paymaya server. This commit fixed the issue by skip CSRF check.

tuyennn commented 4 years ago

CSRF should be implement certain on use Magento\Framework\App\CsrfAwareActionInterface;

as

class ReturnAction extends Action\Action implements CsrfAwareActionInterface
{
    public function createCsrfValidationException(RequestInterface $request): ?InvalidRequestException
    {
        return null;
    }

    public function validateForCsrf(RequestInterface $request): ?bool
    {
        return true;
    }
}