slapos_wechat: Fixup security for anonymous access while verifing payment

master/bt5/slapos_wechat/SkinTemplateItem/portal_skins/slapos_wechat/Base_queryWechatOrderStatusByTradeNo.py

@@ -2,7 +2,7 @@ if not trade_no:
   raise Exception("You need to provide a trade number")
 
 portal = context.getPortalObject()
-payment = portal.restrictedTraverse("accounting_module/%s" % trade_no)
+payment = portal.accounting_module[trade_no]
 
 if not payment:
   raise Exception("The payment with reference %s was not found" % trade_no)

master/bt5/slapos_wechat/SkinTemplateItem/portal_skins/slapos_wechat/Base_queryWechatOrderStatusByTradeNo.xml

@@ -52,6 +52,14 @@
             <key> <string>_params</string> </key>
             <value> <string>trade_no=None</string> </value>
         </item>
+        <item>
+            <key> <string>_proxy_roles</string> </key>
+            <value>
+              <tuple>
+                <string>Manager</string>
+              </tuple>
+            </value>
+        </item>
         <item>
             <key> <string>id</string> </key>
             <value> <string>Base_queryWechatOrderStatusByTradeNo</string> </value>

master/bt5/slapos_wechat/SkinTemplateItem/portal_skins/slapos_wechat/PaymentTransaction_createWechatEvent.xml

@@ -52,6 +52,14 @@
             <key> <string>_params</string> </key>
             <value> <string>REQUEST=None, **kw</string> </value>
         </item>
+        <item>
+            <key> <string>_proxy_roles</string> </key>
+            <value>
+              <tuple>
+                <string>Manager</string>
+              </tuple>
+            </value>
+        </item>
         <item>
             <key> <string>id</string> </key>
             <value> <string>PaymentTransaction_createWechatEvent</string> </value>

master/bt5/slapos_wechat/SkinTemplateItem/portal_skins/slapos_wechat/PaymentTransaction_getWechatId.xml

@@ -52,6 +52,14 @@
             <key> <string>_params</string> </key>
             <value> <string>REQUEST=None</string> </value>
         </item>
+        <item>
+            <key> <string>_proxy_roles</string> </key>
+            <value>
+              <tuple>
+                <string>Manager</string>
+              </tuple>
+            </value>
+        </item>
         <item>
             <key> <string>id</string> </key>
             <value> <string>PaymentTransaction_getWechatId</string> </value>

master/bt5/slapos_wechat/SkinTemplateItem/portal_skins/slapos_wechat/PaymentTransaction_updateWechatPaymentStatus.xml

@@ -52,6 +52,14 @@
             <key> <string>_params</string> </key>
             <value> <string></string> </value>
         </item>
+        <item>
+            <key> <string>_proxy_roles</string> </key>
+            <value>
+              <tuple>
+                <string>Manager</string>
+              </tuple>
+            </value>
+        </item>
         <item>
             <key> <string>id</string> </key>
             <value> <string>PaymentTransaction_updateWechatPaymentStatus</string> </value>

master/bt5/slapos_wechat/SkinTemplateItem/portal_skins/slapos_wechat/WechatEvent_processUpdate.xml

@@ -52,6 +52,14 @@
             <key> <string>_params</string> </key>
             <value> <string>data_kw, REQUEST=None</string> </value>
         </item>
+        <item>
+            <key> <string>_proxy_roles</string> </key>
+            <value>
+              <tuple>
+                <string>Manager</string>
+              </tuple>
+            </value>
+        </item>
         <item>
             <key> <string>id</string> </key>
             <value> <string>WechatEvent_processUpdate</string> </value>

master/bt5/slapos_wechat/WorkflowTemplateItem/portal_workflow/wechat_interface_workflow/scripts/WechatEvent_generateNavigationPage.py

@@ -11,7 +11,7 @@ if transaction_id is None:
 
 wechat_dict = {
   'out_trade_no': payment_transaction.getId().encode('utf-8'),
-  'total_fee': str(int(round((payment_transaction.PaymentTransaction_getTotalPayablePrice() * 100), 0))),
+  'total_fee': int(round((payment_transaction.PaymentTransaction_getTotalPayablePrice() * -100), 0)),
   'fee_type': payment_transaction.getResourceValue().Currency_getIntegrationMapping(),
   'body': "Rapid Space Virtual Machine".encode('utf-8')
 }

master/bt5/slapos_wechat/WorkflowTemplateItem/portal_workflow/wechat_interface_workflow/scripts/WechatEvent_updateStatus.xml

@@ -52,6 +52,14 @@
             <key> <string>_params</string> </key>
             <value> <string>state_change</string> </value>
         </item>
+        <item>
+            <key> <string>_proxy_roles</string> </key>
+            <value>
+              <tuple>
+                <string>Manager</string>
+              </tuple>
+            </value>
+        </item>
         <item>
             <key> <string>id</string> </key>
             <value> <string>WechatEvent_updateStatus</string> </value>