From 4d38f91bd5790d597ec0ac2681149b13a507ce19 Mon Sep 17 00:00:00 2001 From: Dennis Reimann Date: Mon, 9 Dec 2024 17:40:29 +0100 Subject: [PATCH] POS: Fix throttling for unauthenticated users Fixes a regression introduced with d24adda70084f0f807d2a98d204b16b509ae2397: The negation for the `_rateLimitService.Throttle` result was removed with that commit, which lead to all unauthenticated request getting throttled. (It was correctly implemented in #6415. Fixes btcpayserver/app#131. --- BTCPayServer.Tests/SeleniumTests.cs | 10 ++++++++++ .../PointOfSale/Controllers/UIPointOfSaleController.cs | 6 +++--- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/BTCPayServer.Tests/SeleniumTests.cs b/BTCPayServer.Tests/SeleniumTests.cs index 944325c03..7d6074727 100644 --- a/BTCPayServer.Tests/SeleniumTests.cs +++ b/BTCPayServer.Tests/SeleniumTests.cs @@ -2903,6 +2903,16 @@ namespace BTCPayServer.Tests // Unauthenticated user can't access recent transactions s.GoToUrl(keypadUrl); s.Driver.ElementDoesNotExist(By.Id("RecentTransactionsToggle")); + + // But they can generate invoices + s.Driver.FindElement(By.CssSelector(".keypad [data-key='1']")).Click(); + s.Driver.FindElement(By.CssSelector(".keypad [data-key='2']")).Click(); + s.Driver.FindElement(By.CssSelector(".keypad [data-key='3']")).Click(); + s.Driver.FindElement(By.Id("pay-button")).Click(); + s.Driver.WaitUntilAvailable(By.Id("Checkout")); + s.Driver.FindElement(By.Id("DetailsToggle")).Click(); + s.Driver.WaitForElement(By.Id("PaymentDetails-TotalFiat")); + Assert.Contains("1,23 €", s.Driver.FindElement(By.Id("PaymentDetails-TotalFiat")).Text); } [Fact] diff --git a/BTCPayServer/Plugins/PointOfSale/Controllers/UIPointOfSaleController.cs b/BTCPayServer/Plugins/PointOfSale/Controllers/UIPointOfSaleController.cs index c7678e9b8..c26b2d7c4 100644 --- a/BTCPayServer/Plugins/PointOfSale/Controllers/UIPointOfSaleController.cs +++ b/BTCPayServer/Plugins/PointOfSale/Controllers/UIPointOfSaleController.cs @@ -430,9 +430,9 @@ namespace BTCPayServer.Plugins.PointOfSale.Controllers } private async Task Throttle(string appId) => - HttpContext.Connection is { RemoteIpAddress: { } addr } && - await _rateLimitService.Throttle(ZoneLimits.PublicInvoices, addr.ToString(), HttpContext.RequestAborted) && - !(await _authorizationService.AuthorizeAsync(HttpContext.User, appId, Policies.CanViewInvoices)).Succeeded; + !(await _authorizationService.AuthorizeAsync(HttpContext.User, appId, Policies.CanViewInvoices)).Succeeded && + HttpContext.Connection is { RemoteIpAddress: { } addr } && + !await _rateLimitService.Throttle(ZoneLimits.PublicInvoices, addr.ToString(), HttpContext.RequestAborted); private JObject TryParseJObject(string posData) {