View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0011873 | Taler | merchant backend | public | 2026-10-14 14:22 | 2026-10-29 20:18 |
| Reporter | vecirex | Assigned To | Christian Grothoff | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | high | Severity | major | Reproducibility | have not tried |
| Status | informing | Resolution | reopened | ||
| Product Version | git (master) | ||||
| Target Version | 1.6 | Fixed in Version | 1.6 | ||
| Summary | 0011873: merchant: reject @ in merchant_base_url / instance id (breaks /pay ec=2008) | ||||
| Description | Related to 0011866 (Case 2). Problem: merchant_base_url in the contract embeds the instance id. If the instance id contains '@' (e.g., kontakt@example.ch), the URL becomes https://HOST/instances/kontakt@example.ch/ and fails TALER_url_valid_charset on /pay re-parse (TALER_JSON_spec_web_url_copy). Wallet /pay then returns HTTP 500 ec=2008 (pay-no-deposit). Journal: WARNING ... Failed to parse proto contract at field merchant_base_url ASSERT ... pay.c (contract parse) HTTP 500 ec=2008 This is independent of bare merchant.website (0011848 / #11849). The website field can be a valid https URL while merchant_base_url is still invalid. taler_pay_uri also embeds the instance id, so the payment URI path is affected as well. Observed charset (exchange src/util/url.c): no '@' (...9/:;&?-.,=_~%+#). Desired: - Reject instance ids / merchant_base_url values that contain characters outside TALER_url_valid_charset (at least '@') on instance create and PATCH. - Prefer a clear client-facing error at write time instead of /pay 500. - Optionally document allowed instance-id charset for operators. cf. 0011866 (repro/test ticket for /pay 500 with invalid merchant URL) cf. https://git.taler.net/taler/exchange/file/src/util/url.c.html | ||||
| Tags | mytops, quality | ||||
| Wrong ticket: only hotfix done, product fix pending; cf. 0011866 | |
| latest merchant enforces ID constraints on schema, preventing this from happening. Note that DB migrations may FAIL hard if bad identifiers are still anywhere in the DB. | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2026-10-14 14:22 | vecirex | New Issue | |
| 2026-10-14 14:22 | vecirex | Status | new => assigned |
| 2026-10-14 14:22 | vecirex | Assigned To | => Florian Dold |
| 2026-10-14 14:22 | vecirex | Priority | normal => high |
| 2026-10-14 14:22 | vecirex | Tag Attached: mytops | |
| 2026-10-14 14:22 | vecirex | Tag Attached: quality | |
| 2026-10-14 14:25 | vecirex | Assigned To | Florian Dold => vecirex |
| 2026-10-14 14:33 | vecirex | Status | assigned => new |
| 2026-10-14 14:33 | vecirex | Assigned To | vecirex => |
| 2026-10-14 16:50 | Christian Grothoff | Assigned To | => Christian Grothoff |
| 2026-10-14 16:50 | Christian Grothoff | Status | new => assigned |
| 2026-10-29 10:38 | vecirex | Status | assigned => closed |
| 2026-10-29 10:38 | vecirex | Resolution | open => fixed |
| 2026-10-29 10:38 | vecirex | Status | closed => assigned |
| 2026-10-29 10:38 | vecirex | Resolution | fixed => reopened |
| 2026-10-29 10:40 | vecirex | Note Added: 0030169 | |
| 2026-10-29 20:18 | Christian Grothoff | Status | assigned => informing |
| 2026-10-29 20:18 | Christian Grothoff | Fixed in Version | => 1.6 |
| 2026-10-29 20:18 | Christian Grothoff | Note Added: 0030171 | |
| 2026-10-29 20:18 | Christian Grothoff | Product Version | => git (master) |
| 2026-10-29 20:18 | Christian Grothoff | Target Version | => 1.6 |
| 2026-10-29 20:18 | Christian Grothoff | Description Updated |