Plugin maintenance and version bumps

Plugins/BTCPayServer.Plugins.BitcoinSwitch/BTCPayServer.Plugins.BitcoinSwitch.csproj

@@ -9,7 +9,7 @@
     <PropertyGroup>
         <Product>Bitcoin Switch</Product>
         <Description>Control harwdare using the POS as a switch</Description>
-        <Version>1.0.3</Version>
+        <Version>1.0.4</Version>
         <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
     </PropertyGroup>
     <!-- Plugin development properties -->

Plugins/BTCPayServer.Plugins.BitcoinSwitch/BitcoinSwitchService.cs

@@ -174,11 +174,22 @@
                             return;
                         foreach (var socket in sockets)
                         {
-                            await socket.SendAsync(
-                                new ArraySegment<byte>(buffer),
-                                WebSocketMessageType.Text,
-                                true,
-                                cancellationToken);
+                            // Isolate each socket with its own timeout so one stalled or faulted
+                            // listener can't block or abort delivery to the real device.
+                            try
+                            {
+                                using var sendCts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+                                sendCts.CancelAfter(TimeSpan.FromSeconds(5));
+                                await socket.SendAsync(
+                                    new ArraySegment<byte>(buffer),
+                                    WebSocketMessageType.Text,
+                                    true,
+                                    sendCts.Token);
+                            }
+                            catch (Exception ex)
+                            {
+                                Logs.PayServer.LogWarning(ex, "Failed to send BitcoinSwitch command to a socket; continuing");
+                            }
                         }
 
                     }
@@ -193,7 +204,7 @@
         /// <summary>
         /// Parses a settings string like "25-5000.0,delay 1000,23-200.0" into a sequence of actions.
         /// </summary>
         private List<SwitchAction>? ParseActions(string settings)
         {
             try
             {

Plugins/BTCPayServer.Plugins.Blink/BTCPayServer.Plugins.Blink.csproj

@@ -9,7 +9,7 @@
     <PropertyGroup>
         <Product>Blink</Product>
         <Description>Blink Lightning support</Description>
-        <Version>1.1.1</Version>
+        <Version>1.1.2</Version>
 <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
         <RootNamespace>BTCPayServer.Plugins.Blink</RootNamespace>
     </PropertyGroup>

Plugins/BTCPayServer.Plugins.Blink/BlinkLnAddressLightningClient.cs

@@ -622,7 +622,6 @@ internal enum VerifyOutcome
     private LightningInvoice BuildInvoice(string paymentHash, TrackedInvoice tracked, bool settled, string? preimage)
     {
         var bolt11 = BOLT11PaymentRequest.Parse(tracked.Bolt11, _network);
-        var status = DetermineStatus(settled, tracked.ExpiresAt, DateTimeOffset.UtcNow);
 
         // The authoritative payment hash is the verify key (the `paymentHash` argument = BTCPay's
         // invoice Id), NOT the hash parsed from the returned `pr`. blink-lnurl-server's verify
@@ -642,11 +641,13 @@ private LightningInvoice BuildInvoice(string paymentHash, TrackedInvoice tracked
         var reportedBolt11 = bolt11Matches ? tracked.Bolt11 : null;
         var reportedAmount = bolt11Matches ? bolt11.MinimumAmount : null;
 
-        // BTCPay validates the preimage: it must be 64 hex chars and SHA256(preimage)==paymentHash.
-        // If invalid, drop it (the payment is still recorded, just without a preimage).
+        // Require a valid preimage (64 hex chars, SHA256(preimage)==paymentHash) before reporting the
+        // invoice as paid; a settled flag without that proof is not trusted.
         var validPreimage = settled ? ValidatePreimage(paymentHash, preimage) : null;
-        if (settled && preimage is not null && validPreimage is null)
-            _logger.LogWarning("Blink preimage for {PaymentHash} did not validate against the payment hash; discarding.", paymentHash);
+        if (settled && validPreimage is null)
+            _logger.LogWarning("Blink reported {PaymentHash} settled without a valid preimage; not marking paid.", paymentHash);
+        var paid = validPreimage is not null && reportedAmount is not null;
+        var status = DetermineStatus(paid, tracked.ExpiresAt, DateTimeOffset.UtcNow);
 
         return new LightningInvoice
         {
@@ -655,10 +656,10 @@ private LightningInvoice BuildInvoice(string paymentHash, TrackedInvoice tracked
             BOLT11 = reportedBolt11,
             // Amount is parsed from the BOLT11; BTCPay requires a non-null amount to record payment.
             Amount = reportedAmount,
-            AmountReceived = settled ? reportedAmount : null,
+            AmountReceived = paid ? reportedAmount : null,
             Status = status,
             Preimage = validPreimage,
-            PaidAt = settled ? DateTimeOffset.UtcNow : null,
+            PaidAt = paid ? DateTimeOffset.UtcNow : null,
             ExpiresAt = tracked.ExpiresAt
         };
     }

Plugins/BTCPayServer.Plugins.Blink/BlinkPlugin.cs

@@ -12,7 +12,7 @@ public class BlinkPlugin : BaseBTCPayServerPlugin
     {
         public override IBTCPayServerPlugin.PluginDependency[] Dependencies { get; } =
         {
-            new() { Identifier = nameof(BTCPayServer), Condition = ">=2.3.7" }
+            new() { Identifier = nameof(BTCPayServer), Condition = ">=2.4.2" }
 
         };
 

Plugins/BTCPayServer.Plugins.Bringin/BTCPayServer.Plugins.Bringin.csproj

@@ -9,7 +9,7 @@
     <PropertyGroup>
         <Product>Bringin</Product>
         <Description>Euro Offramp</Description>
-        <Version>1.0.6</Version>
+        <Version>1.0.7</Version>
 <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
     </PropertyGroup>
     <!-- Plugin development properties -->

Plugins/BTCPayServer.Plugins.Bringin/BringinController.cs

@@ -54,9 +54,13 @@ public async Task<IActionResult> Edit()
     [IgnoreAntiforgeryToken]
     public async Task<IActionResult> Callback(string storeId, string code, [FromBody]BringinVerificationUpdate content)
     {
+        // Authenticate the shared code against read-only settings BEFORE any state change: Update()
+        // takes the store edit lock, so validating first stops an anonymous caller from holding it.
+        var settings = await _bringinService.Get(storeId);
+        if (settings?.Code != code) return BadRequest();
+        if (content.verificationStatus != "APPROVED") return BadRequest("Verification not approved");
+
         var vm = await _bringinService.Update(storeId);
-        if(vm.Code != code) return BadRequest();
-        if(content.verificationStatus != "APPROVED") return BadRequest("Verification not approved");
 
         if (string.IsNullOrEmpty(vm.ApiKey) && !string.IsNullOrEmpty(content.apikey))
         {

Plugins/BTCPayServer.Plugins.Bringin/BringinService.cs

@@ -223,6 +223,8 @@ private async Task<bool> CheckIfNewPayoutsNeeded(string storeId, BringinStoreSet
                 if (methodSetting.Value.FiatThreshold)
                 {
                     var rate = await bringinClient.GetRate();
+                    if (rate.BringinPrice <= 0)
+                        throw new Exception($"Bringin returned an invalid exchange rate ({rate.BringinPrice}).");
                     thresholdAmount = methodSetting.Value.Threshold / rate.BringinPrice;
                 }
 
@@ -279,6 +281,8 @@ await _storeRepository.UpdateSetting(storeId, BringinStoreSettings.BringinSettin
         {
 
             var rate = await bringinClient.GetRate();
+            if (rate.BringinPrice <= 0)
+                throw new Exception($"Bringin returned an invalid exchange rate ({rate.BringinPrice}).");
             var thresholdAmount = supportedMethod.FiatMinimumAmount  / rate.BringinPrice;
             if (amountBtc.ToDecimal(MoneyUnit.BTC) <= thresholdAmount)
             {
@@ -294,6 +298,11 @@ await _storeRepository.UpdateSetting(storeId, BringinStoreSettings.BringinSettin
             PaymentMethod = supportedMethod.bringinMethod
         };
         var order = await bringinClient.PlaceOrder(request);
+        // The Bringin response is untrusted: reject a non-positive amount or one larger than requested
+        // before it becomes a pre-approved payout, so a hostile response can't claim more than intended.
+        if (order.Amount <= 0 || order.Amount > amountBtc.Satoshi)
+            throw new Exception(
+                $"Bringin returned an invalid order amount ({order.Amount} sats) for a {amountBtc.Satoshi} sats request.");
         var orderMoney = Money.Satoshis(order.Amount);
 
         if (!payout)

Plugins/BTCPayServer.Plugins.Conference/BTCPayServer.Plugins.Conference.csproj

@@ -9,7 +9,7 @@
     <PropertyGroup>
         <Product>Conference</Product>
         <Description>Manage conference merchant stores, POS terminals, and sales reporting from a single app</Description>
-        <Version>1.2.0</Version>
+        <Version>1.2.1</Version>
         <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
     </PropertyGroup>
     <!-- Plugin development properties -->

Plugins/BTCPayServer.Plugins.Conference/ConferenceController.cs

@@ -23,6 +23,7 @@ namespace BTCPayServer.Plugins.Conference;
 
 [Authorize(AuthenticationSchemes = AuthenticationSchemes.Cookie)]
 [Authorize(Policy = Policies.CanModifyStoreSettings, AuthenticationSchemes = AuthenticationSchemes.Cookie)]
+[AutoValidateAntiforgeryToken]
 public class ConferenceController : Controller
 {
     private readonly AppService _appService;

Plugins/BTCPayServer.Plugins.DataErasure/BTCPayServer.Plugins.DataErasure.csproj

@@ -9,7 +9,7 @@
     <PropertyGroup>
         <Product>Data Erasure</Product>
         <Description>Allows you to erase user data from invoices after a period of time.</Description>
-        <Version>1.0.5</Version>
+        <Version>1.0.6</Version>
 <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
     </PropertyGroup>
     <!-- Plugin development properties -->

Plugins/BTCPayServer.Plugins.DataErasure/DataErasurePlugin.cs

@@ -9,7 +9,7 @@ public class DataErasurePlugin : BaseBTCPayServerPlugin
     {
         public override IBTCPayServerPlugin.PluginDependency[] Dependencies { get; } =
         {
-            new() { Identifier = nameof(BTCPayServer), Condition = ">=2.4.1" }
+            new() { Identifier = nameof(BTCPayServer), Condition = ">=2.4.2" }
         };
         public override void Execute(IServiceCollection applicationBuilder)
         {