View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0009349 | Taler | challenger | public | 2024-11-22 15:01 | 2025-05-10 04:11 |
| Reporter | Christian Grothoff | Assigned To | Christian Grothoff | ||
| Priority | high | Severity | feature | Reproducibility | N/A |
| Status | closed | Resolution | fixed | ||
| Platform | i7 | OS | Debian GNU/Linux | OS Version | squeeze |
| Product Version | git (master) | ||||
| Target Version | 1.0 | Fixed in Version | 1.0 | ||
| Summary | 0009349: enforce read-only address data in challenger SPA | ||||
| Description | When the address object has the field "read_only: true" set, the SPA should not permit the user to edit the address and only show it. Afterwards, the backend should also be modified to ensure that the address is not changed (as we cannot trust the SPA). | ||||
| Tags | No tags attached. | ||||
| related to | 0009725 | closed | Christian Grothoff | is not possible to use challeger with read_only mode |
|
|
I don't have instructions to create a scenario where this value is returned neither the API reflect where it is. |
|
|
This is what should happen when the KYC-SPA/exchange triggers challenger to validate an address it got from the KYC-SPA forms (say VQF.*). The idea is that challenger should ONLY validate the address, and it would be bad if the user edited it. You should be able to trigger it by giving "/setup" a body with the address (see https://docs.taler.net/core/api-challenger.html#setup), or (theoretically, I could never test it!) by submitting the simple "natural person" VQF form to the exchange and then having the KYC process trigger the challenger-based physical address validation. |
|
|
the read only mode now works but: 1) it can be disabled by calling the `/challenge/$NONCE` (maybe this endpoint should fail with 429?) 2) we should stop using from encoded and use JSON in the same way as the setup 3) should not crash removes_read_only.sh (975 bytes)
#!/bin/bash
# create a challenge in read only mode
NONCE=$(curl -s 'http://challenger.taler.test:1180/setup/1' -X 'POST' -H 'Accept: application/json' -H 'Accept-Language: en-US,en;q=0.9,es;q=0.8' -H 'Authorization: Bearer secret-token:chal-secret' -d '{"ADDRESS_LINES":"addr 123","CONTACT_NAME":"sebas","read_only":true}' | jq .nonce -r)
set -x
# user start the challenge
curl -s 'http://challenger.taler.test:1180/authorize/'$NONCE'?response_type=code&client_id=1&redirect_uri=http%3A%2F%2Fexchange.taler.test%3A1180%2Fkyc-proof%2FemailChallenger&state=yep' \
-X 'POST'
# change the address, even if it fixed
curl 'http://challenger.taler.test:1180/challenge/'$NONCE \
--data-raw 'CONTACT_NAME=sebas&ADDRESS_LINES=addr456' \
# no longer read_only
curl -s 'http://challenger.taler.test:1180/authorize/'$NONCE'?response_type=code&client_id=1&redirect_uri=http%3A%2F%2Fexchange.taler.test%3A1180%2Fkyc-proof%2FemailChallenger&state=yep' \
-X 'POST'
crash_challenger.sh (763 bytes)
#!/bin/bash
# start challenge in read only mode
NONCE=$(curl -s 'http://challenger.taler.test:1180/setup/1' -X 'POST' -H 'Accept: application/json' -H 'Accept-Language: en-US,en;q=0.9,es;q=0.8' -H 'Authorization: Bearer secret-token:chal-secret' -d '{"ADDRESS_LINES":"addr 123","CONTACT_NAME":"sebas","read_only":true}' | jq .nonce -r)
# login
curl -s 'http://challenger.taler.test:1180/authorize/'$NONCE'?response_type=code&client_id=1&redirect_uri=http%3A%2F%2Fexchange.taler.test%3A1180%2Fkyc-proof%2FemailChallenger&state=yep' \
-X 'POST'
# try to change the addres
curl 'http://challenger.taler.test:1180/challenge/'$NONCE \
-H 'Content-Type: application/json' \
-d '{"ADDRESS_LINES":"addr 123","CONTACT_NAME":"sebas","read_only":true}'
|
|
|
10836e529..15f1e00a6 makes the input disabled on read only |
|
|
NULL-deref crash fixed in dd72e4d..733e4c4, as is the read-only check. Plus now JSON upload supported as well. |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2024-11-22 15:01 | Christian Grothoff | New Issue | |
| 2024-11-22 15:01 | Christian Grothoff | Status | new => assigned |
| 2024-11-22 15:01 | Christian Grothoff | Assigned To | => sebasjm |
| 2025-03-06 13:54 | sebasjm | Assigned To | sebasjm => Christian Grothoff |
| 2025-03-06 13:54 | sebasjm | Status | assigned => feedback |
| 2025-03-06 13:54 | sebasjm | Note Added: 0024168 | |
| 2025-03-06 21:27 | Christian Grothoff | Note Added: 0024171 | |
| 2025-03-06 21:28 | Christian Grothoff | Assigned To | Christian Grothoff => sebasjm |
| 2025-03-06 21:28 | Christian Grothoff | Status | feedback => assigned |
| 2025-04-15 18:53 | sebasjm | Relationship added | related to 0009725 |
| 2025-04-17 01:45 | sebasjm | Note Added: 0024587 | |
| 2025-04-17 01:45 | sebasjm | File Added: removes_read_only.sh | |
| 2025-04-17 01:45 | sebasjm | File Added: crash_challenger.sh | |
| 2025-04-17 01:45 | sebasjm | Assigned To | sebasjm => Christian Grothoff |
| 2025-04-17 02:17 | sebasjm | Note Added: 0024588 | |
| 2025-04-17 09:40 | Christian Grothoff | Target Version | 1.0 stretch goals => 1.0 |
| 2025-04-17 11:44 | Christian Grothoff | Status | assigned => resolved |
| 2025-04-17 11:44 | Christian Grothoff | Resolution | open => fixed |
| 2025-04-17 11:44 | Christian Grothoff | Fixed in Version | => 1.0 |
| 2025-04-17 11:44 | Christian Grothoff | Note Added: 0024589 | |
| 2025-05-10 04:11 | Christian Grothoff | Status | resolved => closed |
