paivana

commit 35a08c0857f7ebd1d0c59073ef87dd72eef3ad5f
parent bc6e4389b22ab7da1563b09b2a618435db0f5183
Author: Christian Grothoff <christian@grothoff.org>
Date:   Tue,  4 Aug 2026 13:59:58 +0200

enforce order_id is a slug, prevent NPE on missing host

Diffstat:
M
debian/control
 | 
9
++++-----
M
src/backend/paivana-httpd_pay.c
 | 
4
++--
M
src/backend/paivana-httpd_templates.c
 | 
7
+++++++

3 files changed, 13 insertions(+), 7 deletions(-)
diff --git a/debian/control b/debian/control
@@ -7,8 +7,8 @@ Build-Depends:
  ninja-build,
  debhelper-compat (= 12),
  libgnunet-dev (>=0.24.0),
- libtalerexchange-dev (>= 1.0.0),
- libtalermerchant-dev (>= 1.0.0),
+ libtalerexchange-dev (>= 1.6.10),
+ libtalermerchant-dev (>= 1.6.0),
  libpq-dev (>=15.0),
  pkg-config,
  po-debconf,
@@ -24,8 +24,8 @@ Architecture: any
 Pre-Depends:
  ${misc:Pre-Depends}
 Depends:
- libtalerexchange (>= 1.0.0),
- libtalermerchant (>= 1.0.0),
+ libtalerexchange (>= 1.6.10),
+ libtalermerchant (>= 1.6.0),
  libgnutls30 (>= 3.7.1),
  adduser,
  lsb-base,
@@ -38,4 +38,3 @@ Description: reverse proxy paywall
  .
  paivana-httpd is a reverse proxy that adds a GNU Taler paywall
  in front of some HTTP server.
-
diff --git a/src/backend/paivana-httpd_pay.c b/src/backend/paivana-httpd_pay.c
@@ -360,8 +360,8 @@ PAIVANA_HTTPD_payment_handle (struct PayRequest *ph,
   if (NULL == ph->order_id)
   {
     struct GNUNET_JSON_Specification spec[] = {
-      GNUNET_JSON_spec_string ("order_id",
-                               &ph->order_id),
+      TALER_JSON_spec_slug ("order_id",
+                            &ph->order_id),
       TALER_JSON_spec_web_url ("website",
                                &ph->website),
       GNUNET_JSON_spec_timestamp ("cur_time",
diff --git a/src/backend/paivana-httpd_templates.c b/src/backend/paivana-httpd_templates.c
@@ -228,6 +228,13 @@ make_taler_pay_template_uri (const char *merchant_base_url,
     GNUNET_free (url);
     return NULL;
   }
+  if ( (NULL == uri.scheme) ||
+       (NULL == uri.host) )
+  {
+    GNUNET_break (0);
+    GNUNET_free (url);
+    return NULL;
+  }
   GNUNET_assert (NULL != template_id);
   GNUNET_buffer_write_str (&buf,
                            "taler");