Commit 95eb074e authored by Rafael Monnerat's avatar Rafael Monnerat

slapos_wechat: Base_queryWechatOrderStatusByTradeNo uses shadow person

This API is used by anonymous so we convert the query for the rely on shadow person security
parent 3ba6dd46
...@@ -2,10 +2,22 @@ if not trade_no: ...@@ -2,10 +2,22 @@ if not trade_no:
raise Exception("You need to provide a trade number") raise Exception("You need to provide a trade number")
portal = context.getPortalObject() portal = context.getPortalObject()
person = portal.portal_membership.getAuthenticatedMember().getUserValue()
def wrapWithShadow(payment_transaction):
payment_transaction.PaymentTransaction_updateWechatPaymentStatus()
return payment.getSimulationState()
payment = portal.accounting_module[trade_no] payment = portal.accounting_module[trade_no]
if not payment: if person is None:
raise Exception("The payment with reference %s was not found" % trade_no) if portal.portal_membership.isAnonymousUser():
invoice = payment.getCausalityValue()
if invoice is not None and invoice.getCausalityRelated(portal_type="Subscription Request"):
person = payment.getDestinationSectionValue()
payment.PaymentTransaction_updateWechatPaymentStatus() return person.Person_restrictMethodAsShadowUser(
return payment.getSimulationState() shadow_document=person,
callable_object=wrapWithShadow,
argument_list=[payment])
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment