diff options
| author | Adam Soltys <[email protected]> | 2026-06-19 00:09:21 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-06-19 00:09:21 -0700 |
| commit | 2f0e6d052efbca7f695dda942ab7da6221da3aa9 (patch) | |
| tree | c3c631549538785e3577f6af537238a28a1b429a /Dockerfile.base | |
| parent | 28cc6c706b0bd2b5322393dd3869e4161ec50423 (diff) | |
| download | coinos-ui-2f0e6d052efbca7f695dda942ab7da6221da3aa9.tar.gz coinos-ui-2f0e6d052efbca7f695dda942ab7da6221da3aa9.zip | |
receive/invoice: build POST body from snapshot, don't mutate $derived
The merchant receive and invoice pages mutated the $derived `invoice`
proxy (setType/setAmount/setMemo) then POSTed it. Mutating a $derived
and JSON.stringify-ing it serializes unreliably, so a stale type
(on-chain when lightning was expected) and a stale/10x-shifted amount
could leak from a prior interaction into POST /invoice (funk POS bug).
Build the body as { ...$state.snapshot(invoice), ...changes } so the
intended type/amount/address_type reliably win; update() takes the
plain body. Front-end only.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Diffstat (limited to 'Dockerfile.base')
0 files changed, 0 insertions, 0 deletions