Get missmatching sepa mandate from a party with different company mandates
Process payment wizard is crashing because is trying to set a sepa mandate which belongs to a company that does not fit with payment company.
It is easy to reproduce this bug. Imagine that there is a party which has two sepa mandates:
- Mandate A which belongs to company A
- Mandate B which belongs to company B
When process payment set sepa mandate to a payment from the Company B, the following function may get mandate from A:
@classmethod
def get_sepa_mandates(cls, payments):
mandates = []
for payment in payments:
if payment.sepa_mandate:
if payment.sepa_mandate.is_valid:
mandate = payment.sepa_mandate
else:
mandate = None
else:
for mandate in payment.party.sepa_mandates:
if mandate.is_valid: # This does not ensure correct company
break
else:
mandate = None
mandates.append(mandate)
return mandates
Is valid just check that mandate is in 'validated' state and does not take into account if it belongs to the correct company.
Maybe is it necessary not only check sepa mandate is valid but also check the company fits with its domain?