mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-15 03:39:43 +08:00
c34f2aac8d
This PR combines two security fixes for the discourse-subscriptions plugin. ## Commits ### 1. [`8f0a8e98e9`](8f0a8e98e9) — SECURITY: Fix unauthorized group access via subscription finalize The `/s/finalize` endpoint accepted client-supplied `plan` and `transaction` parameters that determined which group a user would be added to after completing a Stripe payment. During the 3D Secure authentication flow, an authenticated user could complete a cheap subscription in `SubscribeController#create` but supply a premium plan ID when calling `#finalize`, granting themselves access to a higher-tier group they never paid for. This commit fixes the vulnerability by linking the two endpoints server-side using `server_session`. When `#create` produces a transaction requiring 3D Secure authentication (`incomplete` or `open` status), it stores the transaction ID and plan ID in the server session. `#finalize` then reads exclusively from the session instead of accepting client parameters, and clears the entry after successful finalization. On the frontend, `Transaction.finalize()` no longer sends any parameters to the server. (from #434) --- ### 2. [`dcf80dda61`](dcf80dda61) — SECURITY: Use per-request Stripe API key instead of global state Replace `set_api_key` (which mutated global `::Stripe.api_key`) with `set_stripe_api_key` (which stores the key in an instance variable). All Stripe API calls now receive `{ api_key: @stripe_api_key }` as the per-request opts parameter, following the stripe gem's documented per-request configuration pattern. This prevents API key leakage across concurrent requests in multi-threaded environments. (from #590) --- **Security Advisory:** https://github.com/discourse/discourse/security/advisories/GHSA-f866-8fcp-fgvv --- **Security Advisory:** https://github.com/discourse/discourse/security/advisories/GHSA-9vg5-mp49-xghh
96 lines
3.1 KiB
Ruby
96 lines
3.1 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
RSpec.describe DiscourseSubscriptions::Admin::CouponsController do
|
|
before { SiteSetting.discourse_subscriptions_enabled = true }
|
|
|
|
it "is a subclass of AdminController" do
|
|
expect(DiscourseSubscriptions::Admin::CouponsController < ::Admin::AdminController).to eq(true)
|
|
end
|
|
|
|
context "when unauthenticated" do
|
|
it "does nothing" do
|
|
::Stripe::PromotionCode.expects(:list).never
|
|
get "/s/admin/coupons.json"
|
|
expect(response.status).to eq(404)
|
|
end
|
|
end
|
|
|
|
context "when authenticated" do
|
|
let(:admin) { Fabricate(:admin) }
|
|
|
|
before do
|
|
SiteSetting.discourse_subscriptions_secret_key = "secret-key"
|
|
sign_in(admin)
|
|
end
|
|
|
|
describe "#index" do
|
|
it "returns a list of promo codes" do
|
|
::Stripe::PromotionCode
|
|
.expects(:list)
|
|
.with({ limit: 100 }, DiscourseSubscriptions::Stripe.request_opts)
|
|
.returns({ data: [{ id: "promo_123", coupon: { valid: true } }] })
|
|
|
|
get "/s/admin/coupons.json"
|
|
expect(response.status).to eq(200)
|
|
expect(response.parsed_body[0]["id"]).to eq("promo_123")
|
|
end
|
|
|
|
it "only returns valid promo codes" do
|
|
::Stripe::PromotionCode
|
|
.expects(:list)
|
|
.with({ limit: 100 }, DiscourseSubscriptions::Stripe.request_opts)
|
|
.returns({ data: [{ id: "promo_123", coupon: { valid: false } }] })
|
|
|
|
get "/s/admin/coupons.json"
|
|
expect(response.status).to eq(200)
|
|
expect(response.parsed_body).to be_blank
|
|
end
|
|
end
|
|
|
|
describe "#create" do
|
|
it "creates a coupon with an amount off" do
|
|
::Stripe::Coupon
|
|
.expects(:create)
|
|
.with(anything, DiscourseSubscriptions::Stripe.request_opts)
|
|
.returns(id: "coup_123")
|
|
::Stripe::PromotionCode
|
|
.expects(:create)
|
|
.with(anything, DiscourseSubscriptions::Stripe.request_opts)
|
|
.returns({ code: "p123", coupon: { amount_off: 2000 } })
|
|
|
|
post "/s/admin/coupons.json",
|
|
params: {
|
|
promo: "p123",
|
|
discount_type: "amount",
|
|
discount: "2000",
|
|
active: true,
|
|
}
|
|
expect(response.status).to eq(200)
|
|
expect(response.parsed_body["code"]).to eq("p123")
|
|
expect(response.parsed_body["coupon"]["amount_off"]).to eq(2000)
|
|
end
|
|
|
|
it "creates a coupon with a percent off" do
|
|
::Stripe::Coupon
|
|
.expects(:create)
|
|
.with(anything, DiscourseSubscriptions::Stripe.request_opts)
|
|
.returns(id: "coup_123")
|
|
::Stripe::PromotionCode
|
|
.expects(:create)
|
|
.with(anything, DiscourseSubscriptions::Stripe.request_opts)
|
|
.returns({ code: "p123", coupon: { percent_off: 20 } })
|
|
|
|
post "/s/admin/coupons.json",
|
|
params: {
|
|
promo: "p123",
|
|
discount_type: "percent",
|
|
discount: "20",
|
|
active: true,
|
|
}
|
|
expect(response.status).to eq(200)
|
|
expect(response.parsed_body["code"]).to eq("p123")
|
|
expect(response.parsed_body["coupon"]["percent_off"]).to eq(20)
|
|
end
|
|
end
|
|
end
|
|
end
|
