1 files changed, 32 insertions, 33 deletions

diff --git a/src/backend/taler-merchant-httpd_get-orders-ID.c b/src/backend/taler-merchant-httpd_get-orders-ID.c
index 4167c873..8833329a 100644
--- a/src/backend/taler-merchant-httpd_get-orders-ID.c
+++ b/src/backend/taler-merchant-httpd_get-orders-ID.c
@@ -90,7 +90,8 @@ struct GetOrderData
 
   /**
    * fulfillment URL of the contract (valid as long as @e contract_terms is
-   * valid).
+   * valid; but can also be NULL if the contract_terms does not come with
+   * a fulfillment URL).
    */
   const char *fulfillment_url;
 
@@ -560,7 +561,7 @@ send_pay_request (struct GetOrderData *god,
   {
     ret = TALER_MHD_reply_json_pack (god->sc.con,
                                      MHD_HTTP_PAYMENT_REQUIRED,
-                                     "{s:s, s:s, s:s?}",
+                                     "{s:s, s:s?, s:s?}",
                                      "taler_pay_uri",
                                      taler_pay_uri,
                                      "fulfillment_url",
@@ -887,26 +888,14 @@ TMH_get_orders_ID (const struct TMH_RequestHandler *rh,
   }   /* end unclaimed order logic */
 
   if (NULL == god->fulfillment_url)
-  {
-    struct GNUNET_JSON_Specification spec[] = {
-      GNUNET_JSON_spec_string ("fulfillment_url",
-                               &god->fulfillment_url),
-      GNUNET_JSON_spec_end ()
-    };
-
-    if (GNUNET_OK !=
-        GNUNET_JSON_parse (god->contract_terms,
-                           spec,
-                           NULL, NULL))
-    {
-      GNUNET_break (0);
-      return TALER_MHD_reply_with_error (connection,
-                                         MHD_HTTP_INTERNAL_SERVER_ERROR,
-                                         TALER_EC_GET_ORDERS_DB_LOOKUP_ERROR,
-                                         "Merchant database error (contract terms corrupted)");
-    }
-  }
-
+    god->fulfillment_url = json_string_value (json_object_get (
+                                                god->contract_terms,
+                                                "fulfillment_url"));
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+              "Token match: %d, contract match: %d, unclaimed: %d\n",
+              token_match,
+              contract_match,
+              god->unclaimed);
   if ( (god->unclaimed) &&
        (! token_match) )
   {
@@ -917,9 +906,23 @@ TMH_get_orders_ID (const struct TMH_RequestHandler *rh,
                                        TALER_EC_MERCHANT_GET_ORDER_INVALID_TOKEN,
                                        "Claim token invalid");
   }
-  if ( (! token_match) &&
+  if ( ( (! token_match) ||
+         (GNUNET_YES == GNUNET_is_zero (&god->claim_token)) ) &&
        (! contract_match) )
   {
+    if (NULL == god->fulfillment_url)
+    {
+      if (GNUNET_NO ==
+          GNUNET_is_zero (&god->h_contract_terms))
+        return TALER_MHD_reply_with_error (connection,
+                                           MHD_HTTP_FORBIDDEN,
+                                           TALER_EC_GET_ORDER_WRONG_CONTRACT,
+                                           "Contract hash does not match order");
+      return TALER_MHD_reply_with_error (connection,
+                                         MHD_HTTP_FORBIDDEN,
+                                         TALER_EC_MERCHANT_GET_ORDER_INVALID_TOKEN,
+                                         "Claim token invalid");
+    }
     if (god->generate_html)
     {
       /* Contract was claimed (maybe by another device), so this client
@@ -947,16 +950,12 @@ TMH_get_orders_ID (const struct TMH_RequestHandler *rh,
       MHD_destroy_response (reply);
       return ret;
     }
-    else
-    {
-      /* Need to generate JSON reply */
-      return TALER_MHD_reply_json_pack (
-        connection,
-        MHD_HTTP_ACCEPTED,
-        "{s:s}",
-        "fulfillment_url",
-        god->fulfillment_url);
-    }
+    /* Need to generate JSON reply */
+    return TALER_MHD_reply_json_pack (connection,
+                                      MHD_HTTP_ACCEPTED,
+                                      "{s:s}",
+                                      "fulfillment_url",
+                                      god->fulfillment_url);
   }
 
   if (god->unclaimed)