From 2039d0061eaea0d286dfa48d20042875fbee3da0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Tue, 4 Aug 2026 17:32:47 +0200
Subject: [PATCH] Use webhook secret to verify Shopify webhook

Closes #14989
(grafted from 44d5d7ae9388dfb58c105fc52d582a5aa2f99cd2)

--HG--
branch : 8.0
---
 modules/web_shop_shopify/routes.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/modules/web_shop_shopify/routes.py b/modules/web_shop_shopify/routes.py
index 94b12d4e3c..404f85690d 100644
--- a/modules/web_shop_shopify/routes.py
+++ b/modules/web_shop_shopify/routes.py
@@ -29,7 +29,10 @@ def order(request, pool, shop):
     Shop = pool.get('web.shop')
     shop = Shop.get(shop)
 
-    result = verify_webhook_req(request_to_shopify_req(request))
+    result = verify_webhook_req(
+        request_to_shopify_req(request), {
+            'client_secret': shop.shopify_webhook_shared_secret,
+            })
     if not result.ok:
         logger.debug("unauthorized %s", result)
         abort(result.response.status, result.response.body)