0005373: wallet does not properly implement same origin restrictions for resource based payments

ID	Project	Category	View Status	Date Submitted	Last Update
0005373	Taler	wallet (WebExtension)	public	2018-06-29 15:24	2019-12-20 18:11

Reporter	Florian Dold	Assigned To	Florian Dold	Resolution deadline
Implementer		Reviewer
Release signed by		Deployed by
Verifier		Communicator
Data protection authority notification required	No
CSIRT notification required	No
Estimated effort (hours)		Actual effort (hours)	0
Fast-track	No
Work package	none
Priority	high	Severity	major	Reproducibility	have not tried
Status	closed	Resolution	fixed
Product Version	git (master)
Target Version	0.6	Fixed in Version	0.6

Summary	0005373: wallet does not properly implement same origin restrictions for resource based payments
Description	This allows other websites to, in some cases, find out whether a customer has paid for a certain resource URL.
Tags	No tags attached.

Date Modified	Username	Field	Change
2018-06-29 15:24	Florian Dold	New Issue
2018-06-29 15:24	Florian Dold	Status	new => assigned
2018-06-29 15:24	Florian Dold	Assigned To	=> Florian Dold
2018-11-17 23:44	Christian Grothoff	Product Version	=> git (master)
2018-11-17 23:44	Christian Grothoff	Target Version	=> 0.6
2019-09-06 09:10	Florian Dold	Status	assigned => informing
2019-09-06 09:10	Florian Dold	Resolution	open => fixed
2019-09-06 09:10	Florian Dold	Note Added: 0014869
2019-09-16 07:08	Christian Grothoff	Fixed in Version	=> 0.6
2019-12-20 18:11	Christian Grothoff	Status	informing => closed
2023-04-13 18:37	Florian Dold	Category	wallet (WebExtensions) => wallet (WebExtension)

Florian Dold 2019-09-06 09:10 manager ~0014869	Fixed in f6c0108511. We do not actually base this off the origin (as one merchant deployment could have multiple origins for content and backend), but based on the merchant public key. Existing payment redirection only kicks in when we see another contract from the same merchant.