Page MenuHomePhabricator

Gateway Chooser not checking submethod country restrictions correctly
Closed, ResolvedPublic

Description

It was looking for the countries list directly under the submethods key, not checking the country list for each individual submethod. This means that the GatewayChooser would route people to gateways that didn't necessarily support their chosen submethod for their country. For example, non-NL donors whose querystring said submethod=rtbt_ideal would still be sent to Adyen, even though Adyen's payment_submethods.yaml indicates that iDEAL is only supported in NL

rtbt_ideal:

countries:
    - NL: true

First attempt to fix this is already merged: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DonationInterface/+/823683

That attempt had a different bug which would show the 'no form' error to anyone hitting GatewayChooser with a submethod specified, as it used in_array to check for the submethod country value. This only affected production for a few minutes. before the above patch was rolled back. This issue is fixed in in https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DonationInterface/+/824549.

Note about impact: even though banners in theory only show iDEAL for donors located in Netherlands, that geotargeting can be inaccurate due to main cluster geolocation cookies lasting after people travel (see T122097). So, some donors who were no longer in NL may have seen banners with iDEAL buttons, clicked them, and gotten past the Gateway Chooser due to this bug, only to be denied by Adyen beause they were actually not in NL.

Event Timeline

Change 824549 had a related patch set uploaded (by Ejegg; author: Ejegg):

[mediawiki/extensions/DonationInterface@master] GatewayChooser: fix submethod support check

https://gerrit.wikimedia.org/r/824549

Change 824549 merged by jenkins-bot:

[mediawiki/extensions/DonationInterface@master] GatewayChooser: fix submethod support check

https://gerrit.wikimedia.org/r/824549

AndyRussG subscribed.

Thanks so much for finding this and for the fixes!!! :) :)

XenoRyet set Final Story Points to 2.