| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0011215 | Taler | merchant portal webui | public | 2026-03-09 15:04 | 2026-03-20 23:55 |
| Reporter | vecirex | Assigned To | Christian Grothoff | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | urgent | Severity | block | Reproducibility | N/A |
| Status | closed | Resolution | fixed | ||
| Product Version | git (master) | ||||
| Target Version | 1.5 | Fixed in Version | 1.5 | ||
| Summary | 0011215: MFA seems broken (at least) when trying to change IBAN | ||||
| Description | When trying to change the IBAN, a use-case which was common in practice already several times -- sometimes smaller merchants which don't have a collective company form added a wrong IBAN first or other info related to it -- the backoffice SPA cannot use any MFA. | ||||
| Steps To Reproduce | On it. | ||||
| Additional Information | It's not clear yet if this only happens when trying to change the IBAN or if it's a general issue. | ||||
| Tags | No tags attached. | ||||
| Assign to me, to see if I can reproduce or find other areas with that issue. | |
| Via DevConsole (brave) this can be seen. | |
That's also what can be seen on the taler-merchant-httpd via journalctl:[...] Mar 09 16:12:44 betel taler-merchant-httpd[529831]: (Z5DQ9QVBA2HKVST3MA6TQWN54G) INFO Generating JSON response with code 2126 (46-QAWC8WGMW1KXY37T92QXGDMCTA58QSSG7CP1NH4GS4JTY21P5750) Mar 09 16:12:44 betel taler-merchant-httpd[529831]: (Z5DQ9QVBA2HKVST3MA6TQWN54G) INFO Processing /challenge in phase 5 Mar 09 16:12:44 betel taler-merchant-httpd[529831]: (Z5DQ9QVBA2HKVST3MA6TQWN54G) INFO Request for `/instances/merchant1_5_0/challenge/46-QAWC8WGMW1KXY37T92QXGDMCTA58QSSG7CP1NH4GS4JTY21P5750' completed with HTTP status 404 (0) Mar 09 16:13:06 betel taler-merchant-httpd[529831]: (CBJ0Y7F9BZDARE94F57E3N5PEW) INFO Handling request (POST) for URL '/' Mar 09 16:13:06 betel taler-merchant-httpd[529831]: (CBJ0Y7F9BZDARE94F57E3N5PEW) WARNING External protocol violation detected at taler-merchant-httpd_dispatcher.c:1502. Mar 09 16:13:06 betel taler-merchant-httpd[529831]: (CBJ0Y7F9BZDARE94F57E3N5PEW) INFO Generating JSON response with code 20 (POST) Mar 09 16:13:06 betel taler-merchant-httpd[529831]: (CBJ0Y7F9BZDARE94F57E3N5PEW) INFO Request for `/' completed with HTTP status 405 (0) Mar 09 16:13:25 betel taler-merchant-httpd[529831]: (YAN5A16QDH82TJTSWHVNC7VY28) INFO Handling request (POST) for URL '/' Mar 09 16:13:25 betel taler-merchant-httpd[529831]: (YAN5A16QDH82TJTSWHVNC7VY28) WARNING External protocol violation detected at taler-merchant-httpd_dispatcher.c:1502. Mar 09 16:13:25 betel taler-merchant-httpd[529831]: (YAN5A16QDH82TJTSWHVNC7VY28) INFO Generating JSON response with code 20 (POST) Mar 09 16:13:25 betel taler-merchant-httpd[529831]: (YAN5A16QDH82TJTSWHVNC7VY28) INFO Request for `/' completed with HTTP status 405 (0) Mar 09 16:13:31 betel taler-merchant-httpd[529831]: (77G4SXPDJ1WT9FXHCZH5RXBCTR) INFO Handling request (POST) for URL '/instances/merchant1_5_0/challenge/47-NMYBZHXNZFFT2HFNVD4NQ3AE59CX0QJD4AAESQNJXKNM40D547MG' Mar 09 16:13:31 betel taler-merchant-httpd[529831]: (77G4SXPDJ1WT9FXHCZH5RXBCTR) INFO Processing /challenge in phase 0 Mar 09 16:13:31 betel taler-merchant-httpd[529831]: (77G4SXPDJ1WT9FXHCZH5RXBCTR) INFO Processing /challenge in phase 1 Mar 09 16:13:31 betel taler-merchant-httpd[529831]: (77G4SXPDJ1WT9FXHCZH5RXBCTR) ERROR Assertion failed at taler-merchant-httpd_post-challenge-ID.c:550. Mar 09 16:13:31 betel taler-merchant-httpd[529831]: (77G4SXPDJ1WT9FXHCZH5RXBCTR) INFO Generating JSON response with code 2126 (47-NMYBZHXNZFFT2HFNVD4NQ3AE59CX0QJD4AAESQNJXKNM40D547MG) Mar 09 16:13:31 betel taler-merchant-httpd[529831]: (77G4SXPDJ1WT9FXHCZH5RXBCTR) INFO Processing /challenge in phase 5 Mar 09 16:13:31 betel taler-merchant-httpd[529831]: (77G4SXPDJ1WT9FXHCZH5RXBCTR) INFO Request for `/instances/merchant1_5_0/challenge/47-NMYBZHXNZFFT2HFNVD4NQ3AE59CX0QJD4AAESQNJXKNM40D547MG' completed with HTTP status 404 (0) Mar 09 16:13:36 betel taler-merchant-httpd[529831]: (EEESABQN8QVBYXK6BBJ2MEHC6R) INFO Handling request (POST) for URL '/instances/merchant1_5_0/challenge/47-NMYBZHXNZFFT2HFNVD4NQ3AE59CX0QJD4AAESQNJXKNM40D547MG' Mar 09 16:13:36 betel taler-merchant-httpd[529831]: (EEESABQN8QVBYXK6BBJ2MEHC6R) INFO Processing /challenge in phase 0 Mar 09 16:13:36 betel taler-merchant-httpd[529831]: (EEESABQN8QVBYXK6BBJ2MEHC6R) INFO Processing /challenge in phase 1 Mar 09 16:13:36 betel taler-merchant-httpd[529831]: (EEESABQN8QVBYXK6BBJ2MEHC6R) ERROR Assertion failed at taler-merchant-httpd_post-challenge-ID.c:550. Mar 09 16:13:36 betel taler-merchant-httpd[529831]: (EEESABQN8QVBYXK6BBJ2MEHC6R) INFO Generating JSON response with code 2126 (47-NMYBZHXNZFFT2HFNVD4NQ3AE59CX0QJD4AAESQNJXKNM40D547MG) Mar 09 16:13:36 betel taler-merchant-httpd[529831]: (EEESABQN8QVBYXK6BBJ2MEHC6R) INFO Processing /challenge in phase 5 Mar 09 16:13:36 betel taler-merchant-httpd[529831]: (EEESABQN8QVBYXK6BBJ2MEHC6R) INFO Request for `/instances/merchant1_5_0/challenge/47-NMYBZHXNZFFT2HFNVD4NQ3AE59CX0QJD4AAESQNJXKNM40D547MG' completed with HTTP status 404 (0) Mar 09 16:15:33 betel taler-merchant-httpd[529831]: (A8T66MJ4CXA5A33SW4DYGR1HN8) INFO Handling request (POST) for URL '/' Mar 09 16:15:33 betel taler-merchant-httpd[529831]: (A8T66MJ4CXA5A33SW4DYGR1HN8) WARNING External protocol violation detected at taler-merchant-httpd_dispatcher.c:1502. Mar 09 16:15:33 betel taler-merchant-httpd[529831]: (A8T66MJ4CXA5A33SW4DYGR1HN8) INFO Generating JSON response with code 20 (POST) Mar 09 16:15:33 betel taler-merchant-httpd[529831]: (A8T66MJ4CXA5A33SW4DYGR1HN8) INFO Request for `/' completed with HTTP status 405 (0) [...] | |
| Assign to you, CG, while I will do tests with other and new instances. | |
| logs shows that the SPA made a POST request to `/` ??? i can't reproduce it locally | |
| Wild, but the POST to "/" cannot be fixed in the backend, that must be a SPA issue!? Anyway, Hernani is likely testing with the outdated SPA of v1.5.0. Let's repackage and test again. | |
| New Debian package with latest SPA uploaded, please test... | |
| This persists in v1.5.2, needs fix via v1.5.3+. | |
| it can be reproduced with # taler-harness run-integrationtests merchant-self-provision-activation-two-bank-accounts | |