aljaz/btcpayserver
1
0
Fork 0
mirror of https://github.com/aljazceru/btcpayserver.git synced 2025-12-18 22:44:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

Greenfield: Fix invoice refund permission (#5558)

Browse Source
This commit is contained in:
Andrew Camilleri
2023-12-14 11:15:36 +01:00
committed by GitHub
parent 97fda9d362
commit e4aaff5e34
3 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
BTCPayServer/Controllers/GreenField/GreenfieldInvoiceController.cs
View File

@@ -41,6 +41,7 @@ namespace BTCPayServer.Controllers.Greenfield
private readonly RateFetcher _rateProvider; private readonly RateFetcher _rateProvider;
private readonly InvoiceActivator _invoiceActivator; private readonly InvoiceActivator _invoiceActivator;
private readonly ApplicationDbContextFactory _dbContextFactory; private readonly ApplicationDbContextFactory _dbContextFactory;
private readonly IAuthorizationService _authorizationService;
public LanguageService LanguageService { get; } public LanguageService LanguageService { get; }
@@ -48,7 +49,9 @@ namespace BTCPayServer.Controllers.Greenfield
LinkGenerator linkGenerator, LanguageService languageService, BTCPayNetworkProvider btcPayNetworkProvider, LinkGenerator linkGenerator, LanguageService languageService, BTCPayNetworkProvider btcPayNetworkProvider,
CurrencyNameTable currencyNameTable, RateFetcher rateProvider, CurrencyNameTable currencyNameTable, RateFetcher rateProvider,
InvoiceActivator invoiceActivator, InvoiceActivator invoiceActivator,
PullPaymentHostedService pullPaymentService, ApplicationDbContextFactory dbContextFactory) PullPaymentHostedService pullPaymentService,
ApplicationDbContextFactory dbContextFactory,
IAuthorizationService authorizationService)
{ {
_invoiceController = invoiceController; _invoiceController = invoiceController;
_invoiceRepository = invoiceRepository; _invoiceRepository = invoiceRepository;
@@ -59,6 +62,7 @@ namespace BTCPayServer.Controllers.Greenfield
_invoiceActivator = invoiceActivator; _invoiceActivator = invoiceActivator;
_pullPaymentService = pullPaymentService; _pullPaymentService = pullPaymentService;
_dbContextFactory = dbContextFactory; _dbContextFactory = dbContextFactory;
_authorizationService = authorizationService;
LanguageService = languageService; LanguageService = languageService;
} }
@@ -350,7 +354,7 @@ namespace BTCPayServer.Controllers.Greenfield
return this.CreateValidationError(ModelState); return this.CreateValidationError(ModelState);
} }
[Authorize(Policy = Policies.CanModifyStoreSettings, [Authorize(Policy = Policies.CanCreateNonApprovedPullPayments,
AuthenticationSchemes = AuthenticationSchemes.Greenfield)] AuthenticationSchemes = AuthenticationSchemes.Greenfield)]
[HttpPost("~/api/v1/stores/{storeId}/invoices/{invoiceId}/refund")] [HttpPost("~/api/v1/stores/{storeId}/invoices/{invoiceId}/refund")]
public async Task<IActionResult> RefundInvoice( public async Task<IActionResult> RefundInvoice(
@@ -512,6 +516,7 @@ namespace BTCPayServer.Controllers.Greenfield
createPullPayment.Amount = Math.Round(createPullPayment.Amount - reduceByAmount, appliedDivisibility); createPullPayment.Amount = Math.Round(createPullPayment.Amount - reduceByAmount, appliedDivisibility);
} }
createPullPayment.AutoApproveClaims = createPullPayment.AutoApproveClaims && (await _authorizationService.AuthorizeAsync(User, createPullPayment.StoreId ,Policies.CanCreatePullPayments)).Succeeded;
var ppId = await _pullPaymentService.CreatePullPayment(createPullPayment); var ppId = await _pullPaymentService.CreatePullPayment(createPullPayment);
await using var ctx = _dbContextFactory.CreateContext(); await using var ctx = _dbContextFactory.CreateContext();

5
BTCPayServer/Controllers/UIStorePullPaymentsController.PullPayments.cs
View File

@@ -138,11 +138,8 @@ namespace BTCPayServer.Controllers
} }
if (!ModelState.IsValid) if (!ModelState.IsValid)
return View(model); return View(model);
if (model.AutoApproveClaims) model.AutoApproveClaims = model.AutoApproveClaims && (await
{
model.AutoApproveClaims = (await
_authorizationService.AuthorizeAsync(User, storeId, Policies.CanCreatePullPayments)).Succeeded; _authorizationService.AuthorizeAsync(User, storeId, Policies.CanCreatePullPayments)).Succeeded;
}
await _pullPaymentService.CreatePullPayment(new HostedServices.CreatePullPayment() await _pullPaymentService.CreatePullPayment(new HostedServices.CreatePullPayment()
{ {
Name = model.Name, Name = model.Name,

2
BTCPayServer/wwwroot/swagger/v1/swagger.template.invoices.json
View File

@@ -770,7 +770,7 @@
"security": [ "security": [
{ {
"API_Key": [ "API_Key": [
"btcpay.store.canmodifystoresettings" "btcpay.store.cancreatepullpayments"
], ],
"Basic": [] "Basic": []
} }