eliott/worldmonitor
1
0
Fork 0
mirror of https://github.com/koala73/worldmonitor.git synced 2026-04-25 17:14:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(checkout): add www and variant subdomains to returnUrl allowlist (#2737)

Browse Source 
Sentry K7: 14 events. Users on www.worldmonitor.app hit "Invalid
returnUrl" because the allowlist only had the bare domain.
Requires npx convex deploy.
This commit is contained in:
Elie Habib
2026-04-05 19:57:21 +04:00
committed by GitHub
parent aadda3d181
commit 8a4e29d4fb
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
convex/payments/checkout.ts
View File

@@ -50,7 +50,12 @@ async function _createCheckoutSession(
const allowedOrigins = new Set([
"https://worldmonitor.app",
"https://www.worldmonitor.app",
"https://app.worldmonitor.app",
"https://tech.worldmonitor.app",
"https://finance.worldmonitor.app",
"https://commodity.worldmonitor.app",
"https://happy.worldmonitor.app",
new URL(siteUrl).origin,
]);
if (!allowedOrigins.has(parsedReturnUrl.origin)) {