fix bug #5373: only allow existing payment redirection for contracts from the same merchant

1 files changed, 5 insertions, 1 deletions

diff --git a/src/webex/pages/pay.tsx b/src/webex/pages/pay.tsx
index 9041f5d1c..579688db3 100644
--- a/src/webex/pages/pay.tsx
+++ b/src/webex/pages/pay.tsx
@@ -92,10 +92,14 @@ function TalerPayDialog({ talerPayUri }: { talerPayUri: string }) {
   );
 
   const doPayment = async () => {
+    if (payStatus.status !== "payment-possible") {
+      throw Error("invalid state");
+    }
+    const proposalId = payStatus.proposalId;
     setNumTries(numTries + 1);
     try {
       setLoading(true);
-      const res = await wxApi.confirmPay(payStatus!.proposalId!, undefined);
+      const res = await wxApi.confirmPay(proposalId, undefined);
       document.location.href = res.nextUrl;
     } catch (e) {
       console.error(e);