[tryton-commits] [tryton] [default] Use webhook secret to verify Shopify webhook

[Cédric Krier]

details:   https://code.tryton.org/tryton/commit/44d5d7ae9388
branch:    default
user:      Cédric Krier <c...@b2ck.com>
date:      Tue Aug 04 17:32:47 2026 +0200
description:
        Use webhook secret to verify Shopify webhook

        Closes #14989
diffstat:

 modules/web_shop_shopify/routes.py |  5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diffs (15 lines):

diff -r 0d8ca8201d1b -r 44d5d7ae9388 modules/web_shop_shopify/routes.py
--- a/modules/web_shop_shopify/routes.py        Mon Aug 03 12:26:11 2026 +0200
+++ b/modules/web_shop_shopify/routes.py        Tue Aug 04 17:32:47 2026 +0200
@@ -29,7 +29,10 @@
     Shop = pool.get('web.shop')
     shop = Shop.get(shop)
 
-    result = verify_webhook_req(request_to_shopify_req(request))
+    result = verify_webhook_req(
+        request_to_shopify_req(request), {
+            'client_secret': shop.shopify_webhook_shared_secret,
+            })
     if not result.ok:
         logger.debug("unauthorized %s", result)
         abort(result.response.status, result.response.body)