lingo: raise 404 if transaction does not exist (#10033)

combo/apps/lingo/views.py

@@ -20,7 +20,7 @@ import json
 from django.contrib.auth.models import User
 from django.core.urlresolvers import reverse
 from django.http import HttpResponse, HttpResponseRedirect
-from django.http import HttpResponseForbidden
+from django.http import HttpResponseForbidden, Http404
 from django.template.response import TemplateResponse
 from django.utils import timezone
 from django.views.decorators.csrf import csrf_exempt
@@ -198,7 +198,10 @@ class CallbackView(View):
             # cancellation are not signed...
             assert payment_response.signed is True
 
-        transaction = Transaction.objects.get(order_id=payment_response.order_id)
+        try:
+            transaction = Transaction.objects.get(order_id=payment_response.order_id)
+        except Transaction.DoesNotExist:
+            raise Http404
         transaction.status = payment_response.result
         transaction.bank_data = payment_response.bank_data
         transaction.end_date = timezone.now()

tests/test_lingo_payment.py

@@ -161,3 +161,14 @@ def test_payment_callback(regie, user):
     # call return view
     get_resp = client.get(reverse('lingo-return', kwargs={'regie_pk': regie.pk}), data)
     assert get_resp.status_code == 302
+
+
+def test_nonexisting_transaction(regie, user):
+    login()
+    data = {'transaction_id': 'unknown', 'signed': True,
+            'amount': '23', 'ok': True}
+
+    # call callback with GET
+    callback_url = reverse('lingo-callback', kwargs={'regie_pk': regie.id})
+    get_resp = client.get(callback_url, data)
+    assert get_resp.status_code == 404