12 Commits

Include renames

Author	SHA1	Message	Date
Matt Van Horn	1b955da43e	fix: submit epay v2 redirect payments as a POST form ... v2 redirect now keeps the signed fields in the gateway payload, sets submit_method to POST, and leaves PayURL empty, while v1 redirect still returns a query-string PayURL. CreatePayment then returns a same-origin /api/v1/payments/epay-redirect URL taken from the notify URL's scheme and host, with the payment id and a random token in the query, and stores that token on the payload; a zero payment id or a notify URL without an http or https origin fails creation with a config error. GET /api/v1/payments/epay-redirect sits on the callback rate-limit group and is unauthenticated. It answers with an auto-submitting HTML form that POSTs the stored fields to the stored gateway endpoint only when the payment is a pending epay redirect, still within its expiry, not superseded, and the query token matches the stored token by a constant-time compare of SHA-256 digests; every other request is a 404 with no form. Fixes #349	2026-10-06 04:29:41 -07:00
dujiao-next	19654a3849	feat(router): 支付回调、上游回调、渠道 API、礼品卡兑换增加限流	2026-09-15 22:17:40 +08:00
dujiao-next	9f8579ca93	fix(upstream): 鉴权中间件只更新 last_used_at 单列，限流 key 绑定来源 IP	2026-09-15 22:17:40 +08:00
dujiao-next	bbe1b2786c	fix: 增强svg图片格式校验	2026-09-15 20:38:06 +08:00
Pylogmon	f9409e1016	fix(refund): 修复手续费返还死锁及详情字段丢失	2026-08-12 18:59:37 +08:00
Pylogmon	c6e5967978	fix(payment): 支持退款手续费冲回并兼容历史退款	2026-08-11 19:55:39 +08:00
dujiao-next	513619eb94	feat: 增强订单风控配置，主要针对游客下单	2026-08-05 11:27:07 +08:00
dujiao-next	4e5808831c	feat: add Google account sign-in	2026-07-30 15:18:28 +08:00
dujiao-next	4e4d5bbc12	feat: 加固支付安全边界并优化 DujiaoPay 渠道配置	2026-07-27 13:59:31 +08:00
dujiao-next	87cc68b558	fix(selfupdate): 修复一键升级的发布阻断、release notes XSS 与回滚安全缺陷	2026-07-26 20:37:39 +08:00
dujiao-next	1581d98692	fix: close refactor audit findings	2026-07-26 14:48:03 +08:00
dujiao-next	bd5cd2aa15	refactor(http): split server assembly from middleware	2026-07-26 13:08:30 +08:00