At the moment, the return callback does not validate the transaction id generated in tupas_registration_register_form(), which means that valid return url never expires.

This can be tested with any bank service by capturing the return url and accessing it multiple times.

For example, this should work with any site when using Osuuspankki with test credentials:
/tupas_registration_return/3/850028?B02K_VERS=0003&B02K_TIMESTMP=50020161008130801729499&B02K_IDNBR=2472807294&B02K_STAMP=20161008130752850028&B02K_CUSTNAME=TESTI%20ANNA&B02K_KEYVERS=0001&B02K_ALG=02&B02K_CUSTID=081181-9984&B02K_CUSTTYPE=01&B02K_MAC=844AB0CC10330130B0E7B8376AD20C79AC09C4FC

CommentFileSizeAuthor
#8 2815509-validate-transaction-id-8.patch3.29 KBtuutti
#2 2815509-validate-transaction-id-2.patch3.09 KBtuutti

Comments

tuutti created an issue. See original summary.

tuutti’s picture

tuutti commented
StatusFileSize
new 2815509-validate-transaction-id-2.patch3.09 KB
tuutti’s picture

tuutti commented
Status: Active » Needs review

Status: Needs review » Needs work

The last submitted patch, 2: 2815509-validate-transaction-id-2.patch, failed testing.

The last submitted patch, 2: 2815509-validate-transaction-id-2.patch, failed testing.

The last submitted patch, 2: 2815509-validate-transaction-id-2.patch, failed testing.

The last submitted patch, 2: 2815509-validate-transaction-id-2.patch, failed testing.

tuutti’s picture

tuutti commented
Status: Needs work » Needs review
StatusFileSize
new 2815509-validate-transaction-id-8.patch3.29 KB

  • tuutti committed fff0a5d on 7.x-1.x 
    Issue #2815509 by tuutti: Transaction id is not validated
tuutti’s picture

tuutti commented
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.