View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0011564 | Taler | wallet-core | public | 2026-06-26 20:09 | 2026-09-19 14:40 |
| Reporter | Florian Dold | Assigned To | Florian Dold | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | normal | Severity | minor | Reproducibility | have not tried |
| Status | informing | Resolution | fixed | ||
| Target Version | 1.6 | Fixed in Version | 1.6 | ||
| Summary | 0011564: wallet-core should only spend tokens at merchants that issued them, deprecate/ignore {trusted,expected}_domains fields | ||||
| Description | These fields don't have well defined semantics and it might not make sense to match on the merchant backend URL. Thus we'll need a new design in the future. For now, wallet-core should just check that tokens are only spent at merchants that issued them. We should also considering deprecating the fields in the merchant backend. | ||||
| Tags | No tags attached. | ||||
| commit 8c5a66a590db8d11daf69c60d22acd816c0d2b05 (HEAD -> master, origin/master, origin/HEAD) Author: Florian Dold <dold@taler.net> Date: Mon Sep 7 12:24:32 2026 +0200 wallet-core: restrict token spending to the issuing merchant Compare full merchant base URLs with case-insensitive host and instance names. Ignore token domain lists and reject foreign tokens during selection and before generating or reusing payment signatures. Keep legacy API fields for compatibility without allowing them to override the issuer restriction. Issue: https://bugs.taler.net/n/11564 | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2026-06-26 20:09 | Florian Dold | New Issue | |
| 2026-06-26 20:10 | Florian Dold | Assigned To | => Florian Dold |
| 2026-06-26 20:10 | Florian Dold | Status | new => assigned |
| 2026-07-01 16:25 | Florian Dold | Assigned To | Florian Dold => avalos |
| 2026-07-05 22:46 | Christian Grothoff | Relationship added | child of 0009057 |
| 2026-09-03 09:24 | Florian Dold | Assigned To | avalos => Florian Dold |
| 2026-09-03 09:24 | Florian Dold | Target Version | 1.6 => 1.7 |
| 2026-09-07 10:27 | Florian Dold | Status | assigned => informing |
| 2026-09-07 10:27 | Florian Dold | Resolution | open => fixed |
| 2026-09-07 10:27 | Florian Dold | Note Added: 0029915 | |
| 2026-09-19 14:39 | Christian Grothoff | Target Version | 1.7 => 1.6 |
| 2026-09-19 14:40 | Christian Grothoff | Fixed in Version | => 1.6 |