0011394: exchange does not check FORM_ID in POST /kyc-upload/$ID request

ID	Project	Category	View Status	Date Submitted	Last Update
0011394	Taler	exchange	public	2026-05-12 10:45	2026-05-13 05:47

Reporter	Florian Dold	Assigned To	Christian Grothoff	Resolution deadline
Implementer		Reviewer
Release signed by		Deployed by
Verifier		Communicator
Data protection authority notification required	No
CSIRT notification required	No
Estimated effort (hours)		Actual effort (hours)	0
Fast-track	No
Work package	none
Priority	normal	Severity	minor	Reproducibility	always
Status	informing	Resolution	fixed
Product Version	git (master)
Target Version	1.6	Fixed in Version	1.6

Summary	0011394: exchange does not check FORM_ID in POST /kyc-upload/$ID request
Description	The handler for /kyc/upload/$ID only checks the presence of FORM_ID in the payload, but does not check that the FORM_ID actually matches the measure that the form is being uploaded for. This is problematic, as even if the subsequent AML program run checks for the FORM_ID, the uploaded data with the (unsolicited!) FORM_ID will still be persisted to the database, potentially leading to confusion. Reproducer: $ taler-harness run-integrationtests kyc-form-validation
Tags	No tags attached.

Date Modified	Username	Field	Change
2026-05-12 10:45	Florian Dold	New Issue
2026-05-12 13:14	Christian Grothoff	Assigned To	=> Christian Grothoff
2026-05-12 13:14	Christian Grothoff	Status	new => assigned
2026-05-12 13:14	Christian Grothoff	Product Version	=> git (master)
2026-05-12 13:14	Christian Grothoff	Target Version	=> 1.6
2026-05-13 05:47	Christian Grothoff	Status	assigned => informing
2026-05-13 05:47	Christian Grothoff	Resolution	open => fixed
2026-05-13 05:47	Christian Grothoff	Fixed in Version	=> 1.6