[FW][FIX] payment_sips: prevent clearing the session cookie

[fw-bot]

When buying a product on website shop, after the payment with SIPS, the
page is redirected to an Error message: "We are not able to find your
payment, but don't worry. You should receive an email confirming your
payment in a few minutes. If the payment hasn't been confirmed you can
contact us."

To reproduce the error:

1. In Payment Acquirers, enable Sips
2. Go on website shop
3. Add a product to the cart, Checkout
4. Pay with Sips
   • Visa card number: 4100000000000000
5. Back to Web-shop, if the payment has been successfully processed,
   repeat steps 2 -> 4

Error: The message "Your payment has been successfully processed. Thank
you!" is not displayed. Instead, the message "We are not able [...] you
can contact us." is displayed.

This message is displayed when:

odoo/addons/payment/controllers/portal.py

Lines 65 to 69 in 5945806

	if not payment_transaction_ids:
	return {
	'success': False,
	'error': 'no_tx_found',
	}

i.e., when the transactions list is empty. Here is how to get the list:

odoo/addons/payment/controllers/portal.py

Lines 38 to 42 in 5945806

	def get_payment_transaction_ids():
	# return the ids and not the recordset, since we might need to
	# sudo the browse to access all the record
	# I prefer to let the controller chose when to access to payment.transaction using sudo
	return request.session.get("__payment_tx_ids__", [])

It uses the session of the request. The cookie session_id is used to
identify the current session. However, after the payment on SIPS, the
page is redirected to /payment/sips/dpn with a POST request. Since the
session cookie has the attribute SameSite=Lax and the HTTP request is
a POST, the cookie will be filtered out:
https://drive.google.com/file/d/1xfx3YWkfonO3nK-8Rew45uSoR4lkpjpY/view?usp=sharing
(Browser information: This cookie didn't specify a "SameSite" attribute
when it was stored and was defaulted to "SameSite=Lax," and was blocked
because the request was made from a different site and was not initiated
by a top-level navigation. The cookie had to have been set with
"SameSite=None" to enable cross-site usage)
As a result, the server creates a new one. This is the reason why the
transactions list is empty: the list is based on a new session.

Adding the attribute save_session = False to the route will prevent
the server from creating a new session cookie and adding it in the POST
response.

OPW-2518377

Forward-Port-Of: #72267

[robodoo]

Pull request status dashboard.

[fw-bot]

Ping @adwid, @AntoineVDV
Cherrypicking 9ff7d39 of source #72267 failed

stderr:

14:18:12.027089 git.c:344               trace: built-in: git cherry-pick 9ff7d39db1cf0ce9f89b0ddd00176f627f2286b2
error: could not apply 9ff7d39db1c... [FIX] payment_sips: prevent clearing the session cookie
hint: after resolving the conflicts, mark the corrected paths
hint: with 'git add <paths>' or 'git rm <paths>'
hint: and commit the result with 'git commit'
----------
status:

Either perform the forward-port manually (and push to this branch, proceeding as usual) or close this PR (maybe?).

In the former case, you may want to edit this PR message as well.

[adwid]

@robodoo r+