SilverLABS/littleshop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
136 Commits 2 Branches 0 Tags 334 MiB
261c3e0580
Commit Graph

8 Commits

Author SHA1 Message Date
SysAdmin
0f9e92130c Fix login: Make username parameter case-insensitive 
- Changed parameter names to uppercase (Username, Password)
- Convert to lowercase internally for consistency
- Fixes HTTP 500 error when form submits with lowercase field names
 2025-09-24 22:26:16 +01:00
SysAdmin
069930fe40 Revert ForwardedHeaders changes - restore working baseline 
Login was working before these changes. Reverting to known working state
without ForwardedHeaders middleware which was causing routing issues.
 2025-09-24 22:07:14 +01:00
SysAdmin
96a4c178bb Fix HTTP 500 login error: Configure anti-forgery and routing for proxy 
- Re-enabled ValidateAntiForgeryToken attribute
- Configured anti-forgery for proxy environments with SameAsRequest
- Fixed area routing order and constraints
- Added proper forwarded headers middleware
 2025-09-24 22:06:15 +01:00
SysAdmin
bcefd2c6fc Temporarily disable anti-forgery validation for HTTPS proxy compatibility 2025-09-19 16:44:37 +01:00
SysAdmin
d343037bbd Security: Fix critical vulnerabilities and implement security hardening 
CRITICAL SECURITY FIXES:
- Fixed certificate validation bypass vulnerability in BTCPayServerService
  * Removed unsafe ServerCertificateCustomValidationCallback
  * Added environment-specific SSL configuration
  * Production now enforces proper SSL validation

- Fixed overly permissive CORS policy
  * Replaced AllowAnyOrigin() with specific trusted origins
  * Created separate CORS policies for Development/Production/API
  * Configured from appsettings for environment-specific control

- Implemented CSRF protection across admin panel
  * Added [ValidateAntiForgeryToken] to all POST/PUT/DELETE actions
  * Protected 10 admin controllers with anti-forgery tokens
  * Prevents Cross-Site Request Forgery attacks

CONFIGURATION IMPROVEMENTS:
- Created appsettings.Development.json for dev-specific settings
- Added Security:AllowInsecureSSL flag (Development only)
- Added CORS:AllowedOrigins configuration arrays
- Created comprehensive security roadmap (ROADMAP.md)

ALSO FIXED:
- TeleBot syntax errors (Program.cs, MessageFormatter.cs)
- Added enterprise-full-stack-developer output style

Impact: All Phase 1 critical security vulnerabilities resolved
Status: Ready for security review and deployment preparation

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-09-19 11:56:12 +01:00
sysadmin
be4d797c6c BTCPay-infrastructure-recovery 2025-09-04 21:28:47 +01:00
sysadmin
7e364b2a44 "Improve-product-UI-with-individual-bubbles-and-fix-admin-authentication" 2025-08-28 00:22:27 +01:00
sysadmin
a281bb2896 Implement complete e-commerce functionality with shipping and order management 
Features Added:
- Standard e-commerce properties (Price, Weight, shipping fields)
- Order management with Create/Edit views and shipping information
- ShippingRates system for weight-based shipping calculations
- Comprehensive test coverage with JWT authentication tests
- Sample data seeder with 5 orders demonstrating full workflow
- Photo upload functionality for products
- Multi-cryptocurrency payment support (BTC, XMR, USDT, etc.)

Database Changes:
- Added ShippingRates table
- Added shipping fields to Orders (Name, Address, City, PostCode, Country)
- Renamed properties to standard names (BasePrice to Price, ProductWeight to Weight)
- Added UpdatedAt timestamps to models

UI Improvements:
- Added Create/Edit views for Orders
- Added ShippingRates management UI
- Updated navigation menu with Shipping option
- Enhanced Order Details view with shipping information

Sample Data:
- 3 Categories (Electronics, Clothing, Books)
- 5 Products with various prices
- 5 Shipping rates (Royal Mail options)
- 5 Orders in different statuses (Pending to Delivered)
- 3 Crypto payments demonstrating payment flow

Security:
- All API endpoints secured with JWT authentication
- No public endpoints - client apps must authenticate
- Privacy-focused design with minimal data collection

Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-08-20 17:37:24 +01:00