0004745: audit and fix cross origin merchant interaction issues in the wallet

ID	Project	Category	View Status	Date Submitted	Last Update
0004745	Taler	wallet (WebExtension)	public	2016-10-19 19:36	2017-06-06 12:18

Reporter	Florian Dold	Assigned To	Florian Dold	Resolution deadline
Implementer		Reviewer
Release signed by		Deployed by
Verifier		Communicator
Data protection authority notification required	No
CSIRT notification required	No
Estimated effort (hours)		Actual effort (hours)	0
Fast-track	No
Work package	none
Priority	normal	Severity	minor	Reproducibility	have not tried
Status	closed	Resolution	fixed
Product Version	git (master)
Target Version	0.3	Fixed in Version	0.3

Summary	0004745: audit and fix cross origin merchant interaction issues in the wallet
Description	Right now we don't check the origin for all operations where we should.
Tags	No tags attached.

Date Modified	Username	Field	Change
2016-10-19 19:36	Florian Dold	New Issue
2016-10-19 19:36	Florian Dold	Status	new => assigned
2016-10-19 19:36	Florian Dold	Assigned To	=> Florian Dold
2016-11-15 14:55	Christian Grothoff	Product Version	=> git (master)
2016-11-15 14:55	Christian Grothoff	Target Version	=> 0.3
2017-04-13 13:54	Florian Dold	Note Added: 0012036
2017-04-13 13:54	Florian Dold	Status	assigned => informing
2017-04-13 13:54	Florian Dold	Resolution	open => fixed
2017-04-15 18:02	Christian Grothoff	Fixed in Version	=> 0.3
2017-06-06 12:18	Christian Grothoff	Status	informing => closed
2023-04-13 18:37	Florian Dold	Category	wallet (WebExtensions) => wallet (WebExtension)

Florian Dold 2017-04-13 13:54 manager ~0012036	This is obsolete now, since we only query contracts via the full URL of the page that we're on. There is no other way to query contracts, and thus no cross origin issues can arise, where merchant foo.taler.net can query a contract from merchant bar.taler.net.