fix #6904

1 files changed, 9 insertions, 1 deletions

diff --git a/src/backend/taler-merchant-httpd_private-post-orders.c b/src/backend/taler-merchant-httpd_private-post-orders.c
index 6208fdcf..ad7cef4b 100644
--- a/src/backend/taler-merchant-httpd_private-post-orders.c
+++ b/src/backend/taler-merchant-httpd_private-post-orders.c
@@ -980,7 +980,15 @@ patch_order (struct MHD_Connection *connection,
                                       "merchant_pub",
                                       GNUNET_JSON_from_data_auto (
                                         &hc->instance->merchant_pub)));
-  /* FIXME: #6904: transform 'true' in $forgettable into random salts! */
+  if (GNUNET_OK !=
+      TALER_JSON_contract_seed_forgettable (order))
+  {
+    return TALER_MHD_reply_with_error (
+      connection,
+      MHD_HTTP_BAD_REQUEST,
+      TALER_EC_GENERIC_JSON_INVALID,
+      "could not compute hash of order due to bogus forgettable fields");
+  }
   /* sanity check result */
   {
     struct GNUNET_HashCode hc;