mirror of
https://github.com/lnbits/lnbits.git
synced 2026-08-20 13:37:35 +02:00
0e3246e6c0
The public payment status endpoint returned the stored preimage in the pending-payment fall-through, leaking valid preimages of unpaid invoices to unauthenticated callers on funding sources that generate the preimage at invoice creation (FakeWallet, CoreLightning, CLNRest, LndRest, LndGrpc, Eclair). Only expose the preimage once the payment is actually successful and scrub it from details in the exception branch. Adds a regression test covering unauthenticated, invalid-key, non-owning-key, expired-invoice and paid-control cases. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| test_admin_api.py | ||
| test_api.py | ||
| test_asset_api.py | ||
| test_audit_api.py | ||
| test_auth.py | ||
| test_auth_api.py | ||
| test_callback_api.py | ||
| test_extension_api.py | ||
| test_extensions_builder_api.py | ||
| test_fiat_api.py | ||
| test_generic.py | ||
| test_lnurl_api.py | ||
| test_node_api.py | ||
| test_payment_api.py | ||
| test_tinyurl_api.py | ||
| test_user_api.py | ||
| test_users.py | ||
| test_wallet_api.py | ||
| test_webpush_api.py | ||
| test_websocket_api.py | ||