View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0011848 | Taler | merchant backend | public | 2026-10-02 10:09 | 2026-11-03 07:02 |
| Reporter | vecirex | Assigned To | Resolution deadline | ||
| Implementer | Christian Grothoff | Reviewer | Bohdan | ||
| Release signed by | Christian Grothoff | Deployed by | vecirex | ||
| Verifier | vecirex | Communicator | |||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | 2 | Actual effort (hours) | 1.92 | ||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | urgent | Severity | major | Reproducibility | have not tried |
| Status | deploying | Resolution | open | ||
| Target Version | 1.6 | ||||
| Summary | 0011848: merchant: enforce http(s) website URL - bare host breaks /pay (pay-no-deposit) since v1.6.15 | ||||
| Description | On /pay, contract re-parse fails when merchant.website is a bare host (e.g., www.example.ch) instead of a full http(s) URL. Observed (merchant log): WARNING ... Failed to parse JSON in merchant.website ASSERT ... TALER_JSON_spec_web_url_copy HTTP 500 ec=2008 pay-no-deposit Since v1.6.15, website is parsed with TALER_JSON_spec_web_url_copy in merchant_parse.c. TALER_is_web_url requires an http or https scheme. Instance create/PATCH already use TALER_JSON_spec_web_url ("website"); legacy DB rows and old contracts still carry bare hosts and break /pay. cf. https://git.taler.net/taler/merchant/commit/567107a79abf3ad446901ec5d4602ea5a5e2b17c.html (2026-08-05, use spec_web_url instead of spec_string where applicable) Possible solution: - Reject bare hosts on write and/or migrate stored website to https://... - Keep create/PATCH web_url checks; align contract re-parse error to a clear client-facing code instead of pay-no-deposit 500 where possible. Code (merchant_parse.c, since 567107a79abf):
TALER_JSON_spec_web_url_copy ("website", &merchant->website),
Valid: https://www.example.ch Invalid: www.example.ch | ||||
| Additional Information | Hotfix (ops): set instance website to a full https URL, e.g., https://www.example.ch -- then /pay succeeds for new contracts. I did this in one production case seen. Does not fix legacy contracts that already embedded a bare host. | ||||
| Tags | mytops, quality | ||||
| I think we should add a merchant backend DB migration to auto-prefix https:// for the Websites that do not have it... | |
| 9cf327e0..c9991b9b implements. | |
| The fix looks good! | |
| already on master | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2026-10-02 10:09 | vecirex | New Issue | |
| 2026-10-02 10:09 | vecirex | Status | new => assigned |
| 2026-10-02 10:09 | vecirex | Assigned To | => Florian Dold |
| 2026-10-02 10:09 | vecirex | Tag Attached: mytops | |
| 2026-10-02 10:09 | vecirex | Tag Attached: quality | |
| 2026-10-07 21:37 | Christian Grothoff | Note Added: 0030086 | |
| 2026-11-02 17:27 | Christian Grothoff | Assigned To | Florian Dold => Christian Grothoff |
| 2026-11-02 17:27 | Christian Grothoff | Implementer | => Christian Grothoff |
| 2026-11-02 17:27 | Christian Grothoff | Reviewer | => Bohdan |
| 2026-11-02 17:27 | Christian Grothoff | Release signed by | => Christian Grothoff |
| 2026-11-02 17:27 | Christian Grothoff | Deployed by | => vecirex |
| 2026-11-02 17:27 | Christian Grothoff | Verifier | => vecirex |
| 2026-11-02 17:27 | Christian Grothoff | Estimated effort (hours) | => 2 |
| 2026-11-02 17:27 | Christian Grothoff | Target Version | => 1.7 |
| 2026-11-02 17:27 | Christian Grothoff | Description Updated | |
| 2026-11-02 17:27 | Christian Grothoff | Additional Information Updated | |
| 2026-11-02 21:14 | Christian Grothoff | Target Version | 1.7 => 1.6 |
| 2026-11-02 23:04 | Christian Grothoff | Assigned To | Christian Grothoff => Bohdan |
| 2026-11-02 23:04 | Christian Grothoff | Status | assigned => reviewing |
| 2026-11-02 23:04 | Christian Grothoff | Note Added: 0030192 | |
| 2026-11-03 00:36 | Bohdan | Note Added: 0030193 | |
| 2026-11-03 00:38 | Bohdan | Assigned To | Bohdan => |
| 2026-11-03 00:38 | Bohdan | Status | reviewing => integrating |
| 2026-11-03 07:02 | Christian Grothoff | Status | integrating => deploying |
| 2026-11-03 07:02 | Christian Grothoff | Note Added: 0030196 |