mirror of
https://github.com/openfoodfoundation/openfoodnetwork
synced 2026-01-25 20:46:48 +00:00
ec3dadfe68
There seemingly shouldn't be any case where this controller actually receives a token param. There's only one place that creates urls that direct to this controller (Stripe authorization emails), and they do not attach any kind of token to the URL. If the user is not logged in here (or doesn't have an access_token in their session), they get asked to log in. Note to future devs: see previous commit for additional context.
28 lines
679 B
Ruby
28 lines
679 B
Ruby
# frozen_string_literal: true
|
|
|
|
class PaymentsController < BaseController
|
|
respond_to :html
|
|
|
|
prepend_before_action :require_logged_in, only: :redirect_to_authorize
|
|
|
|
def redirect_to_authorize
|
|
@payment = Spree::Payment.find(params[:id])
|
|
authorize! :show, @payment.order
|
|
|
|
if url = @payment.cvv_response_message
|
|
redirect_to url
|
|
else
|
|
redirect_to order_url(@payment.order)
|
|
end
|
|
end
|
|
|
|
private
|
|
|
|
def require_logged_in
|
|
return if session[:access_token] || spree_current_user
|
|
|
|
flash[:error] = I18n.t("spree.orders.edit.login_to_view_order")
|
|
redirect_to main_app.root_path(anchor: "login?after_login=#{request.env['PATH_INFO']}")
|
|
end
|
|
end
|