View Issue Details

IDProjectCategoryView StatusLast Update
0011106Talermerchant portal webuipublic2026-04-21 05:19
Reportervecirex Assigned Tovecirex Resolution deadline
ImplementerReviewer 
Release signed byDeployed by 
VerifierCommunicator 
Data protection authority notification requiredNo  
CSIRT notification requiredNo  
Estimated effort (hours)Actual effort (hours)0 
Fast-trackNo
Work packagenone
PrioritynormalSeveritytweakReproducibilityalways
Status closedResolutionfixed 
Product Versiongit (master) 
Target Version1.6Fixed in Version1.6 
Summary0011106: Phone numbers need proper checking
DescriptionIt's easy to see that even numbers like +41 get through for the backend to try to send them, which obviously fails.

TagsNo tags attached.
Attached Files

Required notifications

Address or linkRemarkAdded byNotifiedActions

Relationships

duplicate of 0011105 closedvecirex no phone regex for taler ops 
related to 0011029 closedsebasjm add phone regex validation 
related to 0011107 closedChristian Grothoff Backend for sms auth needs fixing for cases where number wrong (e.g., too short, too long, or invalid (like flipped digit)) 
related to 0011108 implementing Error message when an SMS cannot be delivered (bc of invalid number) should be subtle 

Activities

vecirex

2026-02-18 21:39

administrator   ~0027790

Also the French string for start and end of number needs correction, but this I fix directly in fr.po.

Christian Grothoff

2026-02-19 16:52

manager   ~0027811

See also 0011103: multiple spaces in a row should also NOT be allowed.

sebasjm

2026-02-20 00:04

developer   ~0027825

i think we are running in circles, i saw multiple issue related to the phone validation and this is already fixed in spa 0011029 commit c2b9a77f5

but this requires the merchant deployment to have the configuration option PHONE_REGEX which exposes in /config and the SPA then uses the same validation as the server.
if this is in place, then @vecirex you can disallow any non-valid strings and will prevent all the 400 requests.

IF we require that SPA and backend have a sync default validation then this should be in the spec.
FTR the spa default validation is ^\+[0-9 ]*$

Issue History

Date ModifiedUsernameFieldChange
2026-02-18 21:39vecirexNew Issue
2026-02-18 21:39vecirexFile Added: taler-merchant-better-backoffice-spa-phone-number-not-properly-checked.png
2026-02-18 21:39vecirexNote Added: 0027790
2026-02-18 21:47vecirexRelationship addedrelated to 0011107
2026-02-18 23:52vecirexRelationship addedduplicate of 0011105
2026-02-19 01:50vecirexRelationship addedrelated to 0011108
2026-02-19 16:52Christian GrothoffNote Added: 0027811
2026-02-19 16:52Christian GrothoffAssigned To => sebasjm
2026-02-19 16:52Christian GrothoffStatusnew => assigned
2026-02-19 16:53Christian GrothoffSeverityminor => tweak
2026-02-19 16:53Christian GrothoffTarget Version => 1.8
2026-02-19 17:42Christian GrothoffStatusassigned => implementing
2026-02-19 23:59sebasjmRelationship addedrelated to 0011029
2026-02-20 00:04sebasjmNote Added: 0027825
2026-02-20 00:04sebasjmAssigned Tosebasjm => vecirex
2026-04-20 21:59vecirexStatusimplementing => closed
2026-04-20 21:59vecirexResolutionopen => fixed
2026-04-21 05:19Christian GrothoffProduct Version => git (master)
2026-04-21 05:19Christian GrothoffFixed in Version => 1.6
2026-04-21 05:19Christian GrothoffTarget Version1.8 => 1.6
2026-08-23 14:18Florian DoldCategorymerchant backoffice SPA => merchant portal webui