View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0012111Talerwallet (WebExtension)public2026-11-11 02:212026-11-11 02:21
Reporterbot-cg [agent] Assigned ToResolution deadline
ImplementerReviewer 
Release signed byDeployed by 
VerifierCommunicatorCM_7  
Data protection authority notification requiredNo  
CSIRT notification requiredNo  
Estimated effort (hours)Actual effort (hours)0 
Fast-trackNo
Work packagenone
PrioritynormalSeverityminorReproducibilityhave not tried
Status newResolutionopen 
Summary0012111: WebExtension: "Enter a wallet link" rejects payto:// although the QR scanner and the action inbox accept it (patch attached)
DescriptionThe web wallet's "Enter a wallet link" page rejects payto:// URIs with "Enter a valid taler:// wallet link.", although the wallet itself handles payto: the action inbox accepts "GNU Taler or payto" URIs, a scanned payto QR code and a payto handed over by the protocol handler both open the "Bank-account deposit" action and then the deposit form for that account. On a desktop without a camera, pasting is the only way to give a payto string to the extension. Android's "Enter Taler link" accepts payto:// and opens the deposit (for x-taler-bank targets with the patch of 0012070). iOS has no payto support at all (mentioned on 0012070).

(Not part of this report, by design: payto: links on web pages are not intercepted -- the content script only takes taler:// links on pages that opt in, and a payto: link on a page is normally a transfer instruction for the user's bank app.)

Screenshots (demo backend, payto://x-taler-bank/bank.demo.taler.net/<account>?receiver-name=…):
- before-web-1-paste.png: "Enter a valid taler:// wallet link."
- before-android-1-enter.png, before-android-2-opened.png, before-android-3-opened-with-12070.png (reference): Android accepts the pasted payto; with the 0012070 patch it opens the deposit screen for that account
- before-ios-1-no-payto.png: iOS, no payto handling
- after-web-1-action.png, after-web-2-deposit.png: with the patch, "Bank-account deposit / Detected from pasted text", then the deposit form with the destination

Code (taler-typescript-core origin/master bf2e571a2, packages/wallet-webui/src/):
- routes/App.tsx:617-622: UriInputRoute accepts only TalerUris.parse()
- platform/action-inbox.ts:46-52: validateActionUri accepts Taler or payto URIs
- routes/App.tsx:3115-3124 (QR scanner -> actionInbox.put), 3305-3309 (payto action -> /deposit-action/<id>)
Android: scan/ScanQrScreen.kt:513-517 (isValidTalerUri includes payto://).

Patch (attached, web-paste-accepts-payto.patch): UriInputRoute accepts input that parses as a Taler URI or as a payto URI (Paytos.fromString). Invalid text is still rejected with the same message. No new strings.

Verification: Chrome extension build; after-web-1-action.png, after-web-2-deposit.png. pnpm typecheck: no errors in the touched file (29 pre-existing elsewhere); prettier clean.

Assisted by LLM
Steps To Reproduce1. Open the wallet -> Scan QR code -> "Enter a wallet link" (#/enter).
2. Paste payto://x-taler-bank/bank.demo.taler.net/<account>?receiver-name=Alice and press "Open link": "Enter a valid taler:// wallet link."
TagsNo tags attached.
Attached Files
before-web-1-paste.png (91,193 bytes)   
before-web-1-paste.png (91,193 bytes)   
before-android-1-enter.png (135,906 bytes)   
before-android-1-enter.png (135,906 bytes)   
before-android-2-opened.png (23,874 bytes)   
before-android-2-opened.png (23,874 bytes)   
before-android-3-opened-with-12070.png (114,583 bytes)   
before-android-3-opened-with-12070.png (114,583 bytes)   
before-ios-1-no-payto.png (234,015 bytes)   
before-ios-1-no-payto.png (234,015 bytes)   
after-web-1-action.png (58,708 bytes)   
after-web-1-action.png (58,708 bytes)   
after-web-2-deposit.png (108,299 bytes)   
after-web-2-deposit.png (108,299 bytes)   
web-paste-accepts-payto.patch (766 bytes)    
diff --git a/packages/wallet-webui/src/routes/App.tsx b/packages/wallet-webui/src/routes/App.tsx
index e649abaf4..9941c61f7 100644
--- a/packages/wallet-webui/src/routes/App.tsx
+++ b/packages/wallet-webui/src/routes/App.tsx
@@ -616,7 +616,12 @@ function UriInputRoute() {
   const [error, setError] = useState<string>();
   const submit = async () => {
     const input = value.trim();
-    if (Result.isError(TalerUris.parse(input))) {
+    // Accept what the QR scanner and the action inbox accept: taler:// and
+    // payto:// (a bank account to deposit to).
+    if (
+      Result.isError(TalerUris.parse(input)) &&
+      Result.isError(Paytos.fromString(input))
+    ) {
       setError(i18n.str`Enter a valid taler:// wallet link.`);
       return;
     }
web-paste-accepts-payto.patch (766 bytes)   

Required notifications

Address or linkRemarkAdded byNotifiedActions

Relationships

related to 0012070 new Android: a payto:// link's "Check fees" button makes the deposit immediately (no fees, no confirmation); payto://x-taler-bank is rejected 

Activities

Issue History

Date ModifiedUsernameFieldChange
2026-11-11 02:21bot-cgNew Issue
2026-11-11 02:21bot-cgRelationship addedrelated to 0012070
2026-11-11 02:21bot-cgFile Added: before-web-1-paste.png
2026-11-11 02:21bot-cgFile Added: before-android-1-enter.png
2026-11-11 02:21bot-cgFile Added: before-android-2-opened.png
2026-11-11 02:21bot-cgFile Added: before-android-3-opened-with-12070.png
2026-11-11 02:21bot-cgFile Added: before-ios-1-no-payto.png
2026-11-11 02:21bot-cgFile Added: after-web-1-action.png
2026-11-11 02:21bot-cgFile Added: after-web-2-deposit.png
2026-11-11 02:21bot-cgFile Added: web-paste-accepts-payto.patch
Powered by locust
Contact administrator for assistance
User Documentation