littleshop/LittleShop/Areas/Admin/Controllers/ShippingRatesController.cs
SysAdmin d343037bbd Security: Fix critical vulnerabilities and implement security hardening
CRITICAL SECURITY FIXES:
- Fixed certificate validation bypass vulnerability in BTCPayServerService
  * Removed unsafe ServerCertificateCustomValidationCallback
  * Added environment-specific SSL configuration
  * Production now enforces proper SSL validation

- Fixed overly permissive CORS policy
  * Replaced AllowAnyOrigin() with specific trusted origins
  * Created separate CORS policies for Development/Production/API
  * Configured from appsettings for environment-specific control

- Implemented CSRF protection across admin panel
  * Added [ValidateAntiForgeryToken] to all POST/PUT/DELETE actions
  * Protected 10 admin controllers with anti-forgery tokens
  * Prevents Cross-Site Request Forgery attacks

CONFIGURATION IMPROVEMENTS:
- Created appsettings.Development.json for dev-specific settings
- Added Security:AllowInsecureSSL flag (Development only)
- Added CORS:AllowedOrigins configuration arrays
- Created comprehensive security roadmap (ROADMAP.md)

ALSO FIXED:
- TeleBot syntax errors (Program.cs, MessageFormatter.cs)
- Added enterprise-full-stack-developer output style

Impact: All Phase 1 critical security vulnerabilities resolved
Status: Ready for security review and deployment preparation

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-09-19 11:56:12 +01:00

105 lines
2.9 KiB
C#

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using LittleShop.Services;
using LittleShop.DTOs;
namespace LittleShop.Areas.Admin.Controllers;
[Area("Admin")]
[Authorize(Policy = "AdminOnly")]
public class ShippingRatesController : Controller
{
private readonly IShippingRateService _shippingRateService;
private readonly ILogger<ShippingRatesController> _logger;
public ShippingRatesController(IShippingRateService shippingRateService, ILogger<ShippingRatesController> logger)
{
_shippingRateService = shippingRateService;
_logger = logger;
}
public async Task<IActionResult> Index()
{
var rates = await _shippingRateService.GetAllShippingRatesAsync();
return View(rates);
}
public IActionResult Create()
{
return View(new CreateShippingRateDto());
}
[HttpPost]
[ValidateAntiForgeryToken]
public async Task<IActionResult> Create(CreateShippingRateDto model)
{
if (!ModelState.IsValid)
{
return View(model);
}
var rate = await _shippingRateService.CreateShippingRateAsync(model);
_logger.LogInformation("Created shipping rate {RateId}", rate.Id);
return RedirectToAction(nameof(Index));
}
public async Task<IActionResult> Edit(Guid id)
{
var rate = await _shippingRateService.GetShippingRateByIdAsync(id);
if (rate == null)
{
return NotFound();
}
var model = new UpdateShippingRateDto
{
Name = rate.Name,
Description = rate.Description,
Country = rate.Country,
MinWeight = rate.MinWeight,
MaxWeight = rate.MaxWeight,
Price = rate.Price,
MinDeliveryDays = rate.MinDeliveryDays,
MaxDeliveryDays = rate.MaxDeliveryDays,
IsActive = rate.IsActive
};
ViewData["RateId"] = id;
return View(model);
}
[HttpPost]
[ValidateAntiForgeryToken]
public async Task<IActionResult> Edit(Guid id, UpdateShippingRateDto model)
{
if (!ModelState.IsValid)
{
ViewData["RateId"] = id;
return View(model);
}
var success = await _shippingRateService.UpdateShippingRateAsync(id, model);
if (!success)
{
return NotFound();
}
_logger.LogInformation("Updated shipping rate {RateId}", id);
return RedirectToAction(nameof(Index));
}
[HttpPost]
[ValidateAntiForgeryToken]
public async Task<IActionResult> Delete(Guid id)
{
var success = await _shippingRateService.DeleteShippingRateAsync(id);
if (!success)
{
return NotFound();
}
_logger.LogInformation("Deleted shipping rate {RateId}", id);
return RedirectToAction(nameof(Index));
}
}