akadmin/chatwoot
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Update callbacks_controller.rb

Browse Source
This commit is contained in:
Muhsin
2026-02-17 18:58:11 +05:30
parent cfafab0f08
commit 4791cef4d7
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/shopify/callbacks_controller.rb
+3 -1
View File
@@ -117,7 +117,9 @@ class Shopify::CallbacksController < ApplicationController
# Shopify signs callback parameters with HMAC to prevent tampering
hmac = params[:hmac]
query_params = params.except(:hmac, :controller, :action).to_query
# Convert to unsafe hash to avoid strong parameters restriction, then build query string
# Shopify expects parameters to be sorted alphabetically when computing HMAC
query_params = params.except(:hmac, :controller, :action).to_unsafe_h.sort.to_h.to_query
computed_hmac = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('SHA256'), client_secret, query_params)
ActiveSupport::SecurityUtils.secure_compare(computed_hmac, hmac)