CRITICAL SECURITY FIXES: - Fixed certificate validation bypass vulnerability in BTCPayServerService * Removed unsafe ServerCertificateCustomValidationCallback * Added environment-specific SSL configuration * Production now enforces proper SSL validation - Fixed overly permissive CORS policy * Replaced AllowAnyOrigin() with specific trusted origins * Created separate CORS policies for Development/Production/API * Configured from appsettings for environment-specific control - Implemented CSRF protection across admin panel * Added [ValidateAntiForgeryToken] to all POST/PUT/DELETE actions * Protected 10 admin controllers with anti-forgery tokens * Prevents Cross-Site Request Forgery attacks CONFIGURATION IMPROVEMENTS: - Created appsettings.Development.json for dev-specific settings - Added Security:AllowInsecureSSL flag (Development only) - Added CORS:AllowedOrigins configuration arrays - Created comprehensive security roadmap (ROADMAP.md) ALSO FIXED: - TeleBot syntax errors (Program.cs, MessageFormatter.cs) - Added enterprise-full-stack-developer output style Impact: All Phase 1 critical security vulnerabilities resolved Status: Ready for security review and deployment preparation 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
105 lines
2.9 KiB
C#
105 lines
2.9 KiB
C#
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
using LittleShop.Services;
|
|
using LittleShop.DTOs;
|
|
|
|
namespace LittleShop.Areas.Admin.Controllers;
|
|
|
|
[Area("Admin")]
|
|
[Authorize(Policy = "AdminOnly")]
|
|
public class ShippingRatesController : Controller
|
|
{
|
|
private readonly IShippingRateService _shippingRateService;
|
|
private readonly ILogger<ShippingRatesController> _logger;
|
|
|
|
public ShippingRatesController(IShippingRateService shippingRateService, ILogger<ShippingRatesController> logger)
|
|
{
|
|
_shippingRateService = shippingRateService;
|
|
_logger = logger;
|
|
}
|
|
|
|
public async Task<IActionResult> Index()
|
|
{
|
|
var rates = await _shippingRateService.GetAllShippingRatesAsync();
|
|
return View(rates);
|
|
}
|
|
|
|
public IActionResult Create()
|
|
{
|
|
return View(new CreateShippingRateDto());
|
|
}
|
|
|
|
[HttpPost]
|
|
[ValidateAntiForgeryToken]
|
|
public async Task<IActionResult> Create(CreateShippingRateDto model)
|
|
{
|
|
if (!ModelState.IsValid)
|
|
{
|
|
return View(model);
|
|
}
|
|
|
|
var rate = await _shippingRateService.CreateShippingRateAsync(model);
|
|
_logger.LogInformation("Created shipping rate {RateId}", rate.Id);
|
|
|
|
return RedirectToAction(nameof(Index));
|
|
}
|
|
|
|
public async Task<IActionResult> Edit(Guid id)
|
|
{
|
|
var rate = await _shippingRateService.GetShippingRateByIdAsync(id);
|
|
if (rate == null)
|
|
{
|
|
return NotFound();
|
|
}
|
|
|
|
var model = new UpdateShippingRateDto
|
|
{
|
|
Name = rate.Name,
|
|
Description = rate.Description,
|
|
Country = rate.Country,
|
|
MinWeight = rate.MinWeight,
|
|
MaxWeight = rate.MaxWeight,
|
|
Price = rate.Price,
|
|
MinDeliveryDays = rate.MinDeliveryDays,
|
|
MaxDeliveryDays = rate.MaxDeliveryDays,
|
|
IsActive = rate.IsActive
|
|
};
|
|
|
|
ViewData["RateId"] = id;
|
|
return View(model);
|
|
}
|
|
|
|
[HttpPost]
|
|
[ValidateAntiForgeryToken]
|
|
public async Task<IActionResult> Edit(Guid id, UpdateShippingRateDto model)
|
|
{
|
|
if (!ModelState.IsValid)
|
|
{
|
|
ViewData["RateId"] = id;
|
|
return View(model);
|
|
}
|
|
|
|
var success = await _shippingRateService.UpdateShippingRateAsync(id, model);
|
|
if (!success)
|
|
{
|
|
return NotFound();
|
|
}
|
|
|
|
_logger.LogInformation("Updated shipping rate {RateId}", id);
|
|
return RedirectToAction(nameof(Index));
|
|
}
|
|
|
|
[HttpPost]
|
|
[ValidateAntiForgeryToken]
|
|
public async Task<IActionResult> Delete(Guid id)
|
|
{
|
|
var success = await _shippingRateService.DeleteShippingRateAsync(id);
|
|
if (!success)
|
|
{
|
|
return NotFound();
|
|
}
|
|
|
|
_logger.LogInformation("Deleted shipping rate {RateId}", id);
|
|
return RedirectToAction(nameof(Index));
|
|
}
|
|
} |