Commit Graph

41 Commits

Author SHA1 Message Date
d11n
33d3a25928
Apps: Don't redirect .onion requests to canonical domain (#5776)
Fixes #5729.
2024-02-21 13:34:12 +01:00
d11n
5ad320ee4b
Domain mapping: Redirect root app to canonical URL (#5471)
* Domain mapping: Redirect root app to canonical URL

We already redirect public app URLs to the canonical URL if there's a domain mapping — this adds the same behaviour for apps that are defined as root app as well.

* Refactor

* Refactor once more

Minor cleanups

---------

Co-authored-by: nicolas.dorier <nicolas.dorier@gmail.com>
2023-11-21 20:00:31 +09:00
nicolas.dorier
7546ef7a8e
Dotnet reformat 2023-04-10 11:07:03 +09:00
Andrew Camilleri
f74ea14d8b
Plugins can now build apps (#4608)
* Plugins can now build apps

* fix tests

* fixup

* pluginize existing apps

* Test fixes part 1

* Test fixes part 2

* Fix Crowdfund namespace

* Syntax

* More namespace fixes

* Markup

* Test fix

* upstream fixes

* Add plugin icon

* Fix nullable build warnings

* allow pre popualting app creation

* Fixes after merge

* Make link methods async

* Use AppData as parameter for ConfigureLink

* GetApps by AppType

* Use ConfigureLink on dashboard

* Rename method

* Add properties to indicate stats support

* Property updates

* Test fixes

* Clean up imports

* Fixes after merge

---------

Co-authored-by: Dennis Reimann <mail@dennisreimann.de>
2023-03-17 11:56:32 +09:00
Nicolas Dorier
7b5ce8f70c
CSP: Remove unsafe-eval when vue isn't used (#4747)
* CSP: Remove unsafe-eval when vue isn't used

* Prevent XSS injection via VueJS
2023-03-08 17:57:36 +09:00
nicolas.dorier
fdc47e4a38
Avoid crash when some plugins are installed (#4725) 2023-03-03 20:18:09 +09:00
d11n
23761eacc1
Unset X-Frame-Options header correctly (#4721)
* Unset X-Frame-Options header correctly

According to the [spec](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) there are onlye the `DENY` and `SAMEORIGIN` options, `ALLOW-FROM` being deprecated. Hence we have to actively unset the header, as we made `DENY` the default.

This also unsets the X-Frame-Options header for the public form pages, which fixes #4666.

* Ignore anti forgery token in Forms

---------

Co-authored-by: nicolas.dorier <nicolas.dorier@gmail.com>
2023-03-01 15:27:18 +09:00
d11n
66e1eee010
POS improvements (#4668) 2023-02-23 09:52:37 +01:00
Dennis Reimann
3c344331af
Improve domain mapping constraint
- Fix potential double assignment to appId, leading to an [exception](https://pastebin.com/j8dhtcTE)
- Add port to redirect, which makes it work in dev env
2023-02-10 18:15:54 +01:00
d11n
26248774c2
App domain redirect (#4391)
* Fix duplicates in GetAllApps with allowNoUser

* Use domain mapping as canonical reference and redirect to it

* Revert domain mapping to hostname instead of URL
2023-02-02 20:53:42 +09:00
JesterHodl
ec76acd3a6
Code analysis (#4293)
* Enable NETAnalyzers for whole project

- remove obsolete analyzers so that the .NET Core SDK NETAnalyzers can be used
- enable NETAnalyzers for all projects so that developers can use them by defining the AnalysisMode on individual projects

This is because if we set AnalysisMode to minimal, recommended or all it would spam with warning.
The idea is to be able to turn them on during development to fix recommended stuff without polluting the build output.

Following commits will implement some of the Code Analysis findings

* Performance hints for using char overloads for single characters (CA1834 and CA1847)

CA1834: Use StringBuilder.Append(char) for single character strings
CA1847: Use string.Contains(char) instead of string.Contains(string) with single characters
2022-11-20 17:42:36 +09:00
nicolas.dorier
67eeb4b69a
Allow resolution of any settings via DI 2022-05-24 14:10:19 +09:00
nicolas.dorier
3285f24fe9
Add experimental mode 2022-05-23 10:46:51 +09:00
nicolas.dorier
8bea3dd21e
[Greenfield] if some json property are invalid, throw nice error instead of an exception (fix #2795) 2022-01-10 22:11:04 +09:00
Nicolas Dorier
04b8eafacb
Run dotnet format (#3244) 2021-12-31 16:59:02 +09:00
nicolas.dorier
4f7eeea14e
Greenfield: Improve error message, do not use internal lightning node on store's lightning API 2021-12-16 14:27:34 +09:00
Nicolas Dorier
d7a7382d00
Introduce cheat mode (#2965) 2021-10-11 12:32:09 +09:00
Nicolas Dorier
fc4e47cec6
Add CSP at the website level (#2863) 2021-09-09 21:51:28 +09:00
nicolas.dorier
77d1580ee3
Fix Display app on website root feature 2021-08-13 15:50:26 +09:00
Andrew Camilleri
14e4d2d675
Make CSSThemeManager really only focus on theme (#2457)
* Make Settings Repository cache in memory

* Make use of SettingsRepo directly instead of CssThemeManager

* Completely remove CssThemeManager
2021-07-27 21:08:54 +09:00
Umar Bolatov
a4298e8c19
Ensure root app mapping works (#2415)
close #2414
2021-04-01 11:49:46 +09:00
Nicolas Dorier
14e6e492dd
Refactor domain mapping (#2407) 2021-03-30 11:47:03 +09:00
Andrew Camilleri
aaf85216eb
Split Options in BTCPayOptions (#2175)
* Split Options in BTCPayOptions

* fix spacing
2021-01-02 13:44:28 +01:00
rockstardev
f88c02cccd Removing unused usings, readonly fields where possible 2020-06-28 22:07:48 -05:00
rockstardev
b6c7af32de Cleaning up bom from cs files 2020-06-28 21:44:35 -05:00
nicolas.dorier
51514252b6
Run dotnet format 2020-06-28 17:55:27 +09:00
nicolas.dorier
e75edac3c1
Make .netcoreapp 3.0 build happy 2019-10-03 18:00:07 +09:00
nicolas.dorier
639f5d2fc4
Make sure calling monero related controllers can't be done if the shitcoin is not supported 2019-10-01 15:30:27 +09:00
Andrew Camilleri
51a5d2e812 Refactor XFrames Attribute & simplify pos settings page (#576)
* Enable better error when invoice cannot be created on crowdfund

Closes #572

* Allow all public apps in iframe

* cleanup pos page dev info
2019-01-31 16:56:21 +09:00
nicolas.dorier
0d3364b3da Change button path to api/v1/invoices 2018-09-08 14:53:42 +09:00
nicolas.dorier
6eeef8a866 Remove XFrame on the checkout page 2018-08-29 00:31:23 +09:00
nicolas.dorier
976d9d0cda Add CSP (Disable it if custom theming) 2018-07-12 17:38:21 +09:00
nicolas.dorier
10ceddc709 ReferrerPolicy 2018-07-12 02:38:08 +09:00
nicolas.dorier
5dd57c8064 X-XSS-Protection 2018-07-12 02:23:54 +09:00
nicolas.dorier
a256dd3277 x-content-type-options=nosniff 2018-07-12 01:43:16 +09:00
nicolas.dorier
f0145142a4 Make sure that we don't authenticate call with bitpay auth methods on non bitpay calls 2018-04-29 20:32:43 +09:00
nicolas.dorier
2848caff2e Support Legacy API Key authentication to Bitpay Invoice API 2018-04-29 18:28:04 +09:00
nicolas.dorier
4deb7c3270 Adopt dotnet core editorconfig, big reformating 2017-10-27 17:53:04 +09:00
nicolas.dorier
27200d1fb0 X-Frame-Options 2017-10-13 17:13:21 +09:00
nicolas.dorier
9806cab090 Fix Bitpay api route detection 2017-10-13 14:41:28 +09:00
NicolasDorier
b5c6ed3860 Init 2017-09-13 15:55:16 +09:00