Page MenuHomePhabricator
Create Task
Maniphest T117827

Amazon donor details missing when they donate after session timeout
Closed, ResolvedPublic1 Estimated Story Points
Actions

Description

For example, see this payment: https://sellercentral.amazon.com/hz/me/pmd/payment-details?orderReferenceId=P01-7912778-6884317

There was an initial (declined) auth, then a successful auth 6 hours later. The initial auth has the correct Seller Reference ID (our ct_id), but the later one has an Amazon-generated reference, as happens when we don't set any reference ID. The session has timed out on our side, so we don't remember the ct_id any more.

It would probably work to post back all of the hidden fields with the API call.

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
Amazon: check CSRF token, preserve data after expiryEjeggmediawiki/extensions/DonationInterfacemaster+20 -6
Make Amazon use standard handleDonationRequestEjeggmediawiki/extensions/DonationInterfacemaster+1 -4
Add IDs to more inputs, remove duplicateEjeggmediawiki/extensions/DonationInterfacemaster+11 -13
Customize query in gerrit

Related Objects

Event Timeline

Ejegg created this task.Nov 5 2015, 12:56 AM
Ejegg raised the priority of this task from to Needs Triage.
Ejegg updated the task description. (Show Details)
Ejegg added projects: Fundraising-Backlog, FR-Amazon.
Ejegg subscribed.
Restricted Application added subscribers: StudiesWorld, Aklapper. · View Herald TranscriptNov 5 2015, 12:56 AM
• atgo moved this task from Triage to Sprint +1 on the Fundraising-Backlog board.Nov 5 2015, 6:44 PM
Ejegg claimed this task.Nov 5 2015, 9:07 PM
Ejegg added projects: Fundraising Sprint William Shatner, Unplanned-Sprint-Work.
Ejegg set Security to None.
Ejegg edited a custom field.
Ejegg moved this task from Backlog to Doing on the Fundraising Sprint William Shatner board.Nov 5 2015, 11:48 PM

Ah dang, we're not checking session tokens at all in the Amazon gateway. Needs a slightly different fix.

gerritbot subscribed.Nov 9 2015, 9:08 PM

Change 252109 had a related patch set uploaded (by Ejegg):
Add IDs to more inputs, remove duplicate

https://gerrit.wikimedia.org/r/252109

gerritbot added a project: Patch-For-Review.Nov 9 2015, 9:08 PM

Change 252110 had a related patch set uploaded (by Ejegg):
Make Amazon use standard handleDonationRequest

https://gerrit.wikimedia.org/r/252110

gerritbot added a comment.Nov 9 2015, 9:08 PM

Change 252111 had a related patch set uploaded (by Ejegg):
Amazon: check CSRF token, preserve data after expiry

https://gerrit.wikimedia.org/r/252111

Ejegg moved this task from Doing to Review on the Fundraising Sprint William Shatner board.Nov 9 2015, 9:08 PM
gerritbot added a comment.Nov 10 2015, 4:34 PM

Change 252109 merged by jenkins-bot:
Add IDs to more inputs, remove duplicate

https://gerrit.wikimedia.org/r/252109

gerritbot added a comment.Nov 10 2015, 4:34 PM

Change 252110 merged by jenkins-bot:
Make Amazon use standard handleDonationRequest

https://gerrit.wikimedia.org/r/252110

gerritbot added a comment.Nov 10 2015, 4:34 PM

Change 252111 merged by jenkins-bot:
Amazon: check CSRF token, preserve data after expiry

https://gerrit.wikimedia.org/r/252111

ReleaseTaggerBot added a project: MW-1.27-release (WMF-deploy-2015-11-10_(1.27.0-wmf.6)).Nov 10 2015, 5:00 PM
Ejegg moved this task from Review to Pending Deployment on the Fundraising Sprint William Shatner board.Nov 10 2015, 5:12 PM
• DStrine moved this task from Sprint +1 to Closed Sprint Work Completed in Q2 1516 on the Fundraising-Backlog board.Nov 10 2015, 6:03 PM
• DStrine added a project: Fundraising Sprint X-Ray Spex.Nov 10 2015, 6:08 PM
Ejegg mentioned this in T118296: Clear up Amazon donations that got disconnected from CT ID.Nov 10 2015, 6:08 PM
Ejegg moved this task from Backlog to Pending Deployment on the Fundraising Sprint X-Ray Spex board.Nov 10 2015, 6:25 PM
Ejegg moved this task from Pending Deployment to Done on the Fundraising Sprint X-Ray Spex board.Nov 24 2015, 2:33 AM
• DStrine added a project: Fundraising Sprint Yo La Tengo.Nov 26 2015, 12:21 AM
Ejegg moved this task from Backlog to Done on the Fundraising Sprint Yo La Tengo board.Nov 27 2015, 4:09 PM
• atgo closed this task as Resolved.Dec 2 2015, 8:59 PM
• atgo added subscribers: MBeat33, • atgo.

This is probably a hard one to test & replicate. Closing for now - @MBeat33 if you see another instance, please reopen or make new task.

• DStrine removed a project: Unplanned-Sprint-Work.Dec 15 2015, 6:15 PM
• DStrine edited projects, added: Fr-tech-archived-from-FY-2015/16; removed: Fundraising-Backlog.Jan 11 2018, 9:45 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits