diff --git a/lib/stripe/authorize_response_patcher.rb b/lib/stripe/authorize_response_patcher.rb index 7614ff47be..d67b8dbca9 100644 --- a/lib/stripe/authorize_response_patcher.rb +++ b/lib/stripe/authorize_response_patcher.rb @@ -24,7 +24,8 @@ module Stripe next_action.present? && next_action["type"] == "authorize_with_url" - next_action["authorize_with_url"]["url"] + url = next_action["authorize_with_url"]["url"] + return url if url.match(%r{https?:\/\/[\S]+}) && url.include?("stripe.com") end # This field is used because the Spree code recognizes and stores it diff --git a/spec/controllers/spree/admin/orders/payments/payments_controller_spec.rb b/spec/controllers/spree/admin/orders/payments/payments_controller_spec.rb index 68cd853908..f4cb9161c1 100644 --- a/spec/controllers/spree/admin/orders/payments/payments_controller_spec.rb +++ b/spec/controllers/spree/admin/orders/payments/payments_controller_spec.rb @@ -94,7 +94,7 @@ describe Spree::Admin::PaymentsController, type: :controller do context "where further action is required" do before do allow_any_instance_of(Spree::Payment).to receive(:authorize!) do |payment| - payment.update cvv_response_message: "http://redirect_url" + payment.update cvv_response_message: "https://www.stripe.com/authorize" payment.update state: "pending" end end diff --git a/spec/features/admin/payments_stripe_spec.rb b/spec/features/admin/payments_stripe_spec.rb index 00c110195a..a4467a4f5a 100644 --- a/spec/features/admin/payments_stripe_spec.rb +++ b/spec/features/admin/payments_stripe_spec.rb @@ -70,7 +70,7 @@ feature ' context "with a card that fails on registration because it requires(redirects) extra auth" do before do stub_payment_intents_post_request_with_redirect order: order, - redirect_url: "www.dummy.org" + redirect_url: "https://www.stripe.com/authorize" end it "fails to add a payment due to card error" do diff --git a/spec/lib/stripe/authorize_response_patcher_spec.rb b/spec/lib/stripe/authorize_response_patcher_spec.rb index 1572c1ced5..9ecb800ee2 100644 --- a/spec/lib/stripe/authorize_response_patcher_spec.rb +++ b/spec/lib/stripe/authorize_response_patcher_spec.rb @@ -20,12 +20,12 @@ module Stripe let(:params) { { "status" => "requires_source_action", "next_source_action" => { "type" => "authorize_with_url", - "authorize_with_url" => { "url" => "test_url" } } } + "authorize_with_url" => { "url" => "https://www.stripe.com/authorize" } } } } it "patches response.cvv_result.message with the url in the response" do new_response = patcher.call! - expect(new_response.cvv_result['message']).to eq "test_url" + expect(new_response.cvv_result['message']).to eq "https://www.stripe.com/authorize" end end end