josh/ThordekkCore
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bpay ida fix

Browse Source
This commit is contained in:
luis
2026-09-24 08:04:31 -03:00
parent bbbf3bea53
commit eeb3c0c5c5
2 changed files with 15 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/server/game/Handlers/BattlePayHandler.cpp
+14 -9
View File
@@ -585,24 +585,29 @@ void WorldSession::HandleBattlePayOpenCheckout(WorldPackets::BattlePay::OpenChec
if (!sWorld->getBoolConfig(CONFIG_SHOP_ENABLED))
return;
// Retail answers EVERY OPEN_CHECKOUT with the SSO token, before any rail decision (verified in the
// 12.1.0.69933 newshop capture: the char-select bootstrap OPEN_CHECKOUT {ClientToken 1, ProductID
// 0x417070 "Midnight"} gets SMSG_GENERATE_SSO_TOKEN_RESPONSE echoing ClientToken 1). The shop2
// WebView consumes that token before its first HTTPS call, so a missing reply leaves the store
// frame stuck loading. Deliver it unconditionally (echoing the request u32 1:1), then decide
// whether/how a purchase completes on top of it.
SendGenerateSsoToken(openCheckout.ClientToken);
// Two payment rails, decided by the checked-out product (resolve the advertised productID -> catalog):
//
// Rail B - IN-GAME CURRENCY. A product we route whose Currency is anything but real money is bought on
// the wire. Keep the proven handshake: SMSG_GENERATE_SSO_TOKEN_RESPONSE echoing the request's
// ClientToken 1:1 (COMMERCE_AUDIT C-09 / WOW_TOKEN_RE_68275.md). Answering from here - not from an
// unsolicited push at login - is what lets checkouts #2+ get a reply.
// the wire. The SSO handshake above is all the client needs from the game now (COMMERCE_AUDIT C-09 /
// WOW_TOKEN_RE_68275.md). Answering from here - not from an unsolicited push at login - is what lets
// checkouts #2+ get a reply.
//
// Rail A - REAL MONEY. Either a product explicitly flagged Currency 4 (real money), OR an un-reskinned
// retail catalog card we do not route to a shop_product (e.g. the Midnight expansion, ProductID
// 0x417070). The 12.1.0.69382 sniff proves the client gets NO game-packet response for such a
// product and opens the shop2 web overlay itself; the old 1:1 SSO echo here was only ever correct for
// in-game-currency items. Behaviour is governed by Shop.RealMoney.Mode.
// 0x417070). The client opens the shop2 web overlay itself and any completion arrives from the web
// backend; the token has still been delivered above, matching the 69933 capture. Behaviour past the
// token is governed by Shop.RealMoney.Mode.
ShopProduct const* product = sBattlePayMgr->GetProductByAdvertisedId(openCheckout.ProductID);
if (product && product->Currency != SHOP_CURRENCY_REAL_MONEY)
{
SendGenerateSsoToken(openCheckout.ClientToken);
return;
}
switch (BattlePayMgr::GetRealMoneyMode())
{
src/server/game/Server/Protocol/Opcodes.cpp
+1 -1
View File
@@ -1301,7 +1301,7 @@ void OpcodeTable::InitializeServerOpcodes()
DEFINE_SERVER_OPCODE_HANDLER(SMSG_BATTLE_PAY_CONFIRM_PURCHASE, STATUS_NEVER, CONNECTION_TYPE_REALM);
DEFINE_SERVER_OPCODE_HANDLER(SMSG_BATTLE_PAY_DELIVERY_ENDED, STATUS_NEVER, CONNECTION_TYPE_REALM);
DEFINE_SERVER_OPCODE_HANDLER(SMSG_BATTLE_PAY_DELIVERY_STARTED, STATUS_UNHANDLED, CONNECTION_TYPE_REALM);
DEFINE_SERVER_OPCODE_HANDLER(SMSG_BATTLE_PAY_DISTRIBUTION_ASSIGN_VAS_RESPONSE, STATUS_UNHANDLED, CONNECTION_TYPE_REALM);
DEFINE_SERVER_OPCODE_HANDLER(SMSG_BATTLE_PAY_DISTRIBUTION_ASSIGN_VAS_RESPONSE, STATUS_NEVER, CONNECTION_TYPE_REALM);
DEFINE_SERVER_OPCODE_HANDLER(SMSG_BATTLE_PAY_DISTRIBUTION_UNREVOKED, STATUS_UNHANDLED, CONNECTION_TYPE_REALM);
DEFINE_SERVER_OPCODE_HANDLER(SMSG_BATTLE_PAY_DISTRIBUTION_UPDATE, STATUS_NEVER, CONNECTION_TYPE_REALM);
DEFINE_SERVER_OPCODE_HANDLER(SMSG_BATTLE_PAY_GET_DISTRIBUTION_LIST_RESPONSE, STATUS_NEVER, CONNECTION_TYPE_REALM);