Validate QR shop endpoints via session instead of order token (#356)

TheMilek · web-flow · commit fbfc5e27ac96 · 2026-07-09T14:34:33.000+02:00
diff --git a/UPGRADE-2.2.md b/UPGRADE-2.2.md
@@ -1,3 +1,21 @@
+# UPGRADE FROM 2.2.8 TO 2.2.9
+
+1. Run `yarn install` and `yarn build` to rebuild the shop assets. The bundled
+   `assets/shop/js/mollie/app.js` has changed and the shop will not work correctly until it is
+   rebuilt.
+
+1. The QR-code and thank-you shop endpoints no longer use the order `tokenValue` introduced in
+   2.2.8. Ownership is now proven through the shop session, so both endpoints again accept
+   `?orderId=` and validate it against the session:
+
+   - `GET /{_locale}/get-code` serves the current session cart and rejects a foreign `orderId`
+     with `HTTP 403`; its JSON response returns `orderId`.
+   - `GET /{_locale}/thank-you` expects `?orderId=`, validates it against the session, and
+     returns `HTTP 404` when it is missing or does not match.
+
+   If you have overridden `app.js` or link to these endpoints yourself, switch back from
+   `orderToken` to `orderId`.
+
 # UPGRADE FROM 2.2.7 TO 2.2.8
 
 1. The shop payment webhook now verifies that the Mollie payment belongs to the referenced
diff --git a/assets/shop/js/mollie/app.js b/assets/shop/js/mollie/app.js
@@ -4,7 +4,7 @@ $(function () {
     var disableValidationMollieComponents = false;
     let selectedValue = false;
     let mollieData = $('.online-online-payment__container');
-    let orderToken = null;
+    let orderId = null;
     let qrCodeInterval = null;
     const initialOrderTotal = $('#sylius-summary-grand-total').text();
     const cardActiveClass = 'online-payment__item--active';
@@ -148,8 +148,8 @@ $(function () {
             .then((response) => response.json())
             .then((data) => {
                 let qrCode = data.qrCode;
-                if (orderToken === null) {
-                    orderToken = data.orderToken;
+                if (orderId === null) {
+                    orderId = data.orderId;
                 }
 
                 if (qrCode) {
@@ -158,7 +158,7 @@ $(function () {
                         qrCodeMethod = 'iDeal';
                     }
                     createPopup(qrCode, qrCodeMethod);
-                    qrCodeInterval = setInterval(() => checkQrCode(url + '?orderToken=' + orderToken), 1000);
+                    qrCodeInterval = setInterval(() => checkQrCode(url + '?orderId=' + orderId), 1000);
                 }
             });
     }
@@ -172,7 +172,7 @@ $(function () {
                     let cartVariantDetails = document.getElementById('cart-variant-details')
                     if (cartVariantDetails) {
                         let thankYouPageUrl = cartVariantDetails.getAttribute('data-thankYouPage');
-                        window.location.href = thankYouPageUrl + '?orderToken=' + orderToken;
+                        window.location.href = thankYouPageUrl + '?orderId=' + orderId;
                     }
                 }
             });
diff --git a/src/Controller/Shop/PageRedirectController.php b/src/Controller/Shop/PageRedirectController.php
@@ -25,6 +25,8 @@ class PageRedirectController
 {
     private const ORDER_COMPLETED_STATE = 'completed';
 
+    private const QR_ORDER_ID_SESSION_KEY = 'sylius_mollie_qr_order_id';
+
     public function __construct(
         private readonly RouterInterface $router,
         private readonly OrderRepositoryInterface $orderRepository,
@@ -33,30 +35,34 @@ public function __construct(
 
     public function thankYouAction(Request $request, SessionInterface $session): RedirectResponse
     {
-        $orderToken = $request->get('orderToken');
-        $thankYouPageUrl = $this->router->generate('sylius_shop_order_thank_you');
+        $orderId = $request->get('orderId');
 
-        if (null === $orderToken || '' === $orderToken) {
-            throw new NotFoundHttpException('Order token is required.');
+        if (null === $orderId || '' === $orderId ||
+            (string) $session->get(self::QR_ORDER_ID_SESSION_KEY) !== (string) $orderId) {
+            throw new NotFoundHttpException('Order not found.');
         }
 
         /** @var OrderInterface|null $order */
-        $order = $this->orderRepository->findOneByTokenValue($orderToken);
+        $order = $this->orderRepository->findOneBy(['id' => $orderId]);
 
         if (null === $order) {
-            throw new NotFoundHttpException(sprintf('Order with token "%s" does not exist.', $orderToken));
+            throw new NotFoundHttpException('Order not found.');
         }
 
         $session->set('sylius_order_id', $order->getId());
-        $payment = $order->getLastPayment();
-        $tokenValue = $order->getTokenValue();
 
-        if ($payment?->getState() === self::ORDER_COMPLETED_STATE) {
-            return new RedirectResponse($thankYouPageUrl);
+        if ($order->getLastPayment()?->getState() === self::ORDER_COMPLETED_STATE) {
+            return new RedirectResponse($this->router->generate('sylius_shop_order_thank_you'));
         }
 
-        $cartSummaryUrl = $this->router->generate('sylius_shop_order_show', ['tokenValue' => $tokenValue]);
+        $tokenValue = $order->getTokenValue();
+
+        if (null === $tokenValue) {
+            throw new NotFoundHttpException('Order not found.');
+        }
 
-        return new RedirectResponse($cartSummaryUrl);
+        return new RedirectResponse(
+            $this->router->generate('sylius_shop_order_show', ['tokenValue' => $tokenValue]),
+        );
     }
 }
diff --git a/src/Controller/Shop/QrCodeAction.php b/src/Controller/Shop/QrCodeAction.php
@@ -34,6 +34,8 @@
 
 final class QrCodeAction
 {
+    private const QR_ORDER_ID_SESSION_KEY = 'sylius_mollie_qr_order_id';
+
     public function __construct(
         private readonly MollieLoggerActionInterface $loggerAction,
         private readonly CartContextInterface $cartContext,
@@ -66,6 +68,7 @@ public function createPayment(Request $request): Response
                 $qrCodeObject = $payment->details->qrCode;
                 $this->setQrCodeOnOrder($order, $qrCodeObject->src);
                 $this->setMolliePaymentIdOnOrder($order, $payment->id);
+                $request->getSession()->set(self::QR_ORDER_ID_SESSION_KEY, $order->getId());
 
                 return new JsonResponse(['qrCode' => $qrCodeObject], Response::HTTP_OK);
             } catch (\Exception $e) {
@@ -80,15 +83,15 @@ public function fetchQrCodeFromOrder(Request $request): JsonResponse
     {
         /** @var OrderInterface|null $order */
         $order = $this->cartContext->getCart();
-        $orderToken = $request->get('orderToken');
+        $orderId = $request->get('orderId');
 
-        if (null !== $orderToken && '' !== $orderToken &&
-            (null === $order || $order->getTokenValue() !== $orderToken)) {
-            return new JsonResponse([], Response::HTTP_FORBIDDEN);
+        if (null !== $orderId &&
+            (string) $request->getSession()->get(self::QR_ORDER_ID_SESSION_KEY) !== (string) $orderId) {
+            return new JsonResponse([], Response::HTTP_NOT_FOUND);
         }
 
         return new JsonResponse(
-            ['qrCode' => $order?->getQrCode(), 'orderToken' => $order?->getTokenValue()],
+            ['qrCode' => $order?->getQrCode(), 'orderId' => $order?->getId()],
             Response::HTTP_OK,
         );
     }
diff --git a/tests/Unit/Controller/Shop/PageRedirectControllerTest.php b/tests/Unit/Controller/Shop/PageRedirectControllerTest.php
@@ -26,6 +26,8 @@
 
 final class PageRedirectControllerTest extends TestCase
 {
+    private const QR_ORDER_ID_SESSION_KEY = 'sylius_mollie_qr_order_id';
+
     private MockObject&RouterInterface $router;
 
     private MockObject&OrderRepositoryInterface $orderRepository;
@@ -37,97 +39,107 @@ protected function setUp(): void
         $this->router = $this->createMock(RouterInterface::class);
         $this->orderRepository = $this->createMock(OrderRepositoryInterface::class);
         $this->session = $this->createMock(SessionInterface::class);
+
+        $this->router->method('generate')->willReturnCallback(
+            static fn (string $name, array $parameters = []): string => match ($name) {
+                'sylius_shop_order_thank_you' => '/en_US/order/thank-you',
+                'sylius_shop_order_show' => '/en_US/order/' . ($parameters['tokenValue'] ?? ''),
+                default => '/',
+            },
+        );
     }
 
-    public function testItThrowsNotFoundWhenOrderTokenIsMissing(): void
+    public function testItThrowsNotFoundWhenOrderIdIsMissing(): void
     {
         $this->expectException(NotFoundHttpException::class);
 
-        $this->orderRepository->expects(self::never())->method('findOneByTokenValue');
+        $this->orderRepository->expects(self::never())->method('findOneBy');
 
         $controller = $this->createController();
         $controller->thankYouAction(new Request(), $this->session);
     }
 
-    public function testItThrowsNotFoundWhenOrderTokenIsEmpty(): void
+    public function testItThrowsNotFoundWhenOrderIdIsEmpty(): void
     {
         $this->expectException(NotFoundHttpException::class);
 
-        $this->orderRepository->expects(self::never())->method('findOneByTokenValue');
+        $this->orderRepository->expects(self::never())->method('findOneBy');
 
         $controller = $this->createController();
-        $controller->thankYouAction(new Request(['orderToken' => '']), $this->session);
+        $controller->thankYouAction(new Request(['orderId' => '']), $this->session);
     }
 
-    public function testItThrowsNotFoundWhenOrderTokenIsUnknown(): void
+    public function testItThrowsNotFoundWhenOrderIdDoesNotMatchSession(): void
     {
         $this->expectException(NotFoundHttpException::class);
 
-        $this->orderRepository
-            ->expects(self::once())
-            ->method('findOneByTokenValue')
-            ->with('unknown-token')
-            ->willReturn(null);
+        $this->session->method('get')->with(self::QR_ORDER_ID_SESSION_KEY)->willReturn(99);
+        $this->orderRepository->expects(self::never())->method('findOneBy');
 
         $controller = $this->createController();
-        $controller->thankYouAction(new Request(['orderToken' => 'unknown-token']), $this->session);
+        $controller->thankYouAction(new Request(['orderId' => 42]), $this->session);
     }
 
-    public function testItRedirectsToThankYouPageWhenPaymentIsCompleted(): void
+    public function testItThrowsNotFoundWhenOrderDoesNotExist(): void
     {
-        $order = $this->createOrderMock(42, 'abc123', 'completed');
+        $this->expectException(NotFoundHttpException::class);
+
+        $this->session->method('get')->with(self::QR_ORDER_ID_SESSION_KEY)->willReturn(42);
+        $this->orderRepository->method('findOneBy')->with(['id' => 42])->willReturn(null);
+
+        $controller = $this->createController();
+        $controller->thankYouAction(new Request(['orderId' => 42]), $this->session);
+    }
 
-        $this->orderRepository->method('findOneByTokenValue')->with('abc123')->willReturn($order);
+    public function testItRedirectsToThankYouPageWhenPaymentIsCompleted(): void
+    {
+        $this->session->method('get')->with(self::QR_ORDER_ID_SESSION_KEY)->willReturn(42);
         $this->session->expects(self::once())->method('set')->with('sylius_order_id', 42);
-        $this->router->method('generate')->with('sylius_shop_order_thank_you')->willReturn('/en_US/order/thank-you');
+
+        $order = $this->createOrderMock(42, 'abc123', 'completed');
+        $this->orderRepository->method('findOneBy')->with(['id' => 42])->willReturn($order);
 
         $controller = $this->createController();
-        $response = $controller->thankYouAction(new Request(['orderToken' => 'abc123']), $this->session);
+        $response = $controller->thankYouAction(new Request(['orderId' => 42]), $this->session);
 
         self::assertSame(302, $response->getStatusCode());
         self::assertSame('/en_US/order/thank-you', $response->getTargetUrl());
     }
 
     public function testItRedirectsToOrderShowWhenPaymentIsNotCompleted(): void
     {
-        $order = $this->createOrderMock(42, 'abc123', 'new');
-
-        $this->orderRepository->method('findOneByTokenValue')->with('abc123')->willReturn($order);
+        $this->session->method('get')->with(self::QR_ORDER_ID_SESSION_KEY)->willReturn(42);
         $this->session->expects(self::once())->method('set')->with('sylius_order_id', 42);
-        $this->router->method('generate')->willReturnMap([
-            ['sylius_shop_order_thank_you', [], 1, '/en_US/order/thank-you'],
-            ['sylius_shop_order_show', ['tokenValue' => 'abc123'], 1, '/en_US/order/abc123'],
-        ]);
+
+        $order = $this->createOrderMock(42, 'abc123', 'new');
+        $this->orderRepository->method('findOneBy')->with(['id' => 42])->willReturn($order);
 
         $controller = $this->createController();
-        $response = $controller->thankYouAction(new Request(['orderToken' => 'abc123']), $this->session);
+        $response = $controller->thankYouAction(new Request(['orderId' => 42]), $this->session);
 
         self::assertSame(302, $response->getStatusCode());
         self::assertSame('/en_US/order/abc123', $response->getTargetUrl());
     }
 
-    public function testItSetsSessionFromOrderIdNotFromRequestParameter(): void
+    public function testItThrowsNotFoundWhenOrderHasNoTokenValue(): void
     {
-        $order = $this->createOrderMock(99, 'abc123', 'completed');
+        $this->expectException(NotFoundHttpException::class);
 
-        $this->orderRepository->method('findOneByTokenValue')->willReturn($order);
-        $this->router->method('generate')->willReturn('/en_US/order/thank-you');
+        $this->session->method('get')->with(self::QR_ORDER_ID_SESSION_KEY)->willReturn(42);
 
-        $this->session
-            ->expects(self::once())
-            ->method('set')
-            ->with('sylius_order_id', 99);
+        $order = $this->createOrderMock(42, null, 'new');
+        $this->orderRepository->method('findOneBy')->with(['id' => 42])->willReturn($order);
 
         $controller = $this->createController();
-        $controller->thankYouAction(new Request(['orderToken' => 'abc123']), $this->session);
+        $controller->thankYouAction(new Request(['orderId' => 42]), $this->session);
     }
 
     private function createController(): PageRedirectController
     {
         return new PageRedirectController($this->router, $this->orderRepository);
     }
 
-    private function createOrderMock(int $id, string $tokenValue, string $paymentState): MockObject&OrderInterface
+    private function createOrderMock(int $id, ?string $tokenValue, string $paymentState): MockObject&OrderInterface
     {
         $payment = $this->createMock(PaymentInterface::class);
         $payment->method('getState')->willReturn($paymentState);

Original file line number	Diff line number	Diff line change
`@@ -4,7 +4,7 @@ $(function () {`
`4`	`4`	`var disableValidationMollieComponents = false;`
`5`	`5`	`let selectedValue = false;`
`6`	`6`	`let mollieData = $('.online-online-payment__container');`
`7`		`- let orderToken = null;`
	`7`	`+ let orderId = null;`
`8`	`8`	`let qrCodeInterval = null;`
`9`	`9`	`const initialOrderTotal = $('#sylius-summary-grand-total').text();`
`10`	`10`	`const cardActiveClass = 'online-payment__item--active';`
`@@ -148,8 +148,8 @@ $(function () {`
`148`	`148`	`.then((response) => response.json())`
`149`	`149`	`.then((data) => {`
`150`	`150`	`let qrCode = data.qrCode;`
`151`		`- if (orderToken === null) {`
`152`		`- orderToken = data.orderToken;`
	`151`	`+ if (orderId === null) {`
	`152`	`+ orderId = data.orderId;`
`153`	`153`	`}`
`154`	`154`
`155`	`155`	`if (qrCode) {`
`@@ -158,7 +158,7 @@ $(function () {`
`158`	`158`	`qrCodeMethod = 'iDeal';`
`159`	`159`	`}`
`160`	`160`	`createPopup(qrCode, qrCodeMethod);`
`161`		`- qrCodeInterval = setInterval(() => checkQrCode(url + '?orderToken=' + orderToken), 1000);`
	`161`	`+ qrCodeInterval = setInterval(() => checkQrCode(url + '?orderId=' + orderId), 1000);`
`162`	`162`	`}`
`163`	`163`	`});`
`164`	`164`	`}`
`@@ -172,7 +172,7 @@ $(function () {`
`172`	`172`	`let cartVariantDetails = document.getElementById('cart-variant-details')`
`173`	`173`	`if (cartVariantDetails) {`
`174`	`174`	`let thankYouPageUrl = cartVariantDetails.getAttribute('data-thankYouPage');`
`175`		`- window.location.href = thankYouPageUrl + '?orderToken=' + orderToken;`
	`175`	`+ window.location.href = thankYouPageUrl + '?orderId=' + orderId;`
`176`	`176`	`}`
`177`	`177`	`}`
`178`	`178`	`});`