diff --git a/controller/Users.py b/controller/Users.py index 8a0f041..341058d 100644 --- a/controller/Users.py +++ b/controller/Users.py @@ -1284,7 +1284,7 @@ class Users( object ): # verify item_number plan_index = params.get( u"item_number" ) - if plan_index == None: + if plan_index == None or plan_index == u"": return dict() # ignore this transaction if there's no item number try: diff --git a/controller/test/Test_users.py b/controller/test/Test_users.py index f945dbe..53387eb 100644 --- a/controller/test/Test_users.py +++ b/controller/test/Test_users.py @@ -2725,6 +2725,15 @@ class Test_users( Test_controller ): assert len( result ) == 1 assert result.get( u"session_id" ) + def test_paypal_notify_payment_blank_item_number( self ): + data = dict( self.PAYMENT_DATA ) + data[ u"custom" ] = self.user.object_id + data[ u"item_number" ] = u"" + result = self.http_post( "/users/paypal_notify", data ); + + assert len( result ) == 1 + assert result.get( u"session_id" ) + def test_paypal_notify_payment_incorrect_gross( self ): data = dict( self.PAYMENT_DATA ) data[ u"custom" ] = self.user.object_id