merchant

commit 92ae5d1a2a7fa577ed9fac6dd3facc1852c44e27
parent 758715b9afe583d3c3d40915962bfcc7940182cb
Author: Christian Grothoff <christian@grothoff.org>
Date:   Tue,  4 Aug 2026 22:23:46 +0200

use session_id, not slug, for session_id

Diffstat:
M
src/backend/taler-merchant-httpd_post-orders-ORDER_ID-paid.c
 | 
4
++--
M
src/backend/taler-merchant-httpd_post-orders-ORDER_ID-pay.c
 | 
4
++--
M
src/backend/taler-merchant-httpd_post-private-orders.c
 | 
4
++--
M
src/backend/taler-merchant-httpd_post-templates-TEMPLATE_ID.c
 | 
12
++++++++++++
M
src/testing/test_merchant_order_creation.sh
 | 
2
+-

5 files changed, 19 insertions(+), 7 deletions(-)
diff --git a/src/backend/taler-merchant-httpd_post-orders-ORDER_ID-paid.c b/src/backend/taler-merchant-httpd_post-orders-ORDER_ID-paid.c
@@ -85,8 +85,8 @@ TMH_post_orders_ID_paid (const struct TMH_RequestHandler *rh,
                                    &merchant_sig),
       GNUNET_JSON_spec_fixed_auto ("h_contract",
                                    &hct),
-      TALER_JSON_spec_slug ("session_id",
-                            &session_id),
+      TALER_JSON_spec_nonempty_session_id ("session_id",
+                                           &session_id),
       GNUNET_JSON_spec_end ()
     };
     enum GNUNET_GenericReturnValue res;
diff --git a/src/backend/taler-merchant-httpd_post-orders-ORDER_ID-pay.c b/src/backend/taler-merchant-httpd_post-orders-ORDER_ID-pay.c
@@ -5000,8 +5000,8 @@ phase_parse_pay (struct PayContext *pc)
     GNUNET_JSON_spec_array_const ("coins",
                                   &coins),
     GNUNET_JSON_spec_mark_optional (
-      TALER_JSON_spec_slug ("session_id",
-                            &session_id),
+      TALER_JSON_spec_session_id ("session_id",
+                                  &session_id),
       NULL),
     GNUNET_JSON_spec_mark_optional (
       GNUNET_JSON_spec_object_const ("wallet_data",
diff --git a/src/backend/taler-merchant-httpd_post-private-orders.c b/src/backend/taler-merchant-httpd_post-private-orders.c
@@ -4065,8 +4065,8 @@ phase_parse_request (struct OrderContext *oc)
                                     &ip),
       NULL),
     GNUNET_JSON_spec_mark_optional (
-      TALER_JSON_spec_slug ("session_id",
-                            &oc->parse_request.session_id),
+      TALER_JSON_spec_session_id ("session_id",
+                                  &oc->parse_request.session_id),
       NULL),
     GNUNET_JSON_spec_mark_optional (
       GNUNET_JSON_spec_array_const ("lock_uuids",
diff --git a/src/backend/taler-merchant-httpd_post-templates-TEMPLATE_ID.c b/src/backend/taler-merchant-httpd_post-templates-TEMPLATE_ID.c
@@ -602,6 +602,18 @@ parse_using_templates_paivana_request (
                            ca);
     }
   }
+  if (! TALER_is_session_id (uc->parse_request.paivana.paivana_id))
+  {
+    /* The Paivana ID becomes the session ID of the order, and thus
+       ends up as a path component of the "taler://pay/" URI; the
+       base64url decoding below is too lenient to ensure this. */
+    GNUNET_break_op (0);
+    use_reply_with_error (uc,
+                          MHD_HTTP_BAD_REQUEST,
+                          TALER_EC_GENERIC_PARAMETER_MALFORMED,
+                          "paivana_id");
+    return GNUNET_SYSERR;
+  }
   if (1 !=
       sscanf (uc->parse_request.paivana.paivana_id,
               "%llu-",
diff --git a/src/testing/test_merchant_order_creation.sh b/src/testing/test_merchant_order_creation.sh
@@ -486,7 +486,7 @@ echo "OK"
 NOW=$(date +%s)
 
 echo -n "Pay first order ${PAY_URL} ..."
-taler-wallet-cli \
+timeout 60 taler-wallet-cli \
     --no-throttle \
     --wallet-db="$WALLET_DB" \
     handle-uri "${PAY_URL}" \