etkr4k/bedolaga-cabinet
1
0
Fork 0
mirror of https://github.com/chillpadclub/bedolaga-cabinet.git synced 2026-07-30 02:23:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(topup): harden direct-open guard and admin toggle defenses

Browse Source 
Post-review nits:
* AdminPaymentMethodEdit.tsx: `config.open_url_direct ?? false` when seeding
  state — defends against stale backend rendering (e.g. cache invalidation
  race before migration applies)
* Same file: aria-label now uses the localized `admin.paymentMethods.openUrlDirect`
  translation key instead of hardcoded English
* TopUpAmount.tsx: case-insensitive guard for Telegram deep-link URLs —
  `https://t.me/`, `http://t.me/`, and `tg://` all match regardless of provider
  casing quirks. Lowercase normalization done once before the comparisons.
This commit is contained in:
Fringg
2026-05-13 11:13:33 +03:00
parent aa8bfc9d08
commit 5493c25e5f
2 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/pages/AdminPaymentMethodEdit.tsx
View File

@@ -80,7 +80,8 @@ export default function AdminPaymentMethodEdit() {
setFirstTopupFilter(config.first_topup_filter); setFirstTopupFilter(config.first_topup_filter);
setPromoGroupFilterMode(config.promo_group_filter_mode); setPromoGroupFilterMode(config.promo_group_filter_mode);
setSelectedPromoGroupIds(config.allowed_promo_group_ids); setSelectedPromoGroupIds(config.allowed_promo_group_ids);
setOpenUrlDirect(config.open_url_direct); // ?? false — защита от stale-config (backend ещё не пришёл с миграцией)
setOpenUrlDirect(config.open_url_direct ?? false);
} }
}, [config]); }, [config]);
@@ -236,7 +237,7 @@ export default function AdminPaymentMethodEdit() {
className={`relative h-6 w-11 shrink-0 rounded-full transition-colors ${ className={`relative h-6 w-11 shrink-0 rounded-full transition-colors ${
openUrlDirect ? 'bg-accent-500' : 'bg-dark-600' openUrlDirect ? 'bg-accent-500' : 'bg-dark-600'
}`} }`}
aria-label="Toggle open URL directly" aria-label={t('admin.paymentMethods.openUrlDirect', 'Open payment page directly')}
> >
<span <span
className={`absolute top-1 h-4 w-4 rounded-full bg-white transition-transform ${ className={`absolute top-1 h-4 w-4 rounded-full bg-white transition-transform ${

9
src/pages/TopUpAmount.tsx
View File

@@ -279,7 +279,14 @@ export default function TopUpAmount() {
// handler (openInvoice / openTelegramLink в setPaymentUrl-ветке). // handler (openInvoice / openTelegramLink в setPaymentUrl-ветке).
// Stars уже отбит раньше через starsPaymentMutation, здесь — защита // Stars уже отбит раньше через starsPaymentMutation, здесь — защита
// на случай CryptoBot и других Telegram-deep-link провайдеров. // на случай CryptoBot и других Telegram-deep-link провайдеров.
if (method?.open_url_direct && !redirectUrl.startsWith('https://t.me/')) { // toLowerCase для устойчивости к редким провайдерам, которые могут вернуть
// URL в нестандартном регистре. Также покрываем tg:// scheme на всякий случай.
const lowerUrl = redirectUrl.toLowerCase();
const isTelegramDeepLink =
lowerUrl.startsWith('https://t.me/') ||
lowerUrl.startsWith('http://t.me/') ||
lowerUrl.startsWith('tg://');
if (method?.open_url_direct && !isTelegramDeepLink) {
window.location.href = redirectUrl; window.location.href = redirectUrl;
return; return;
} }