Skip to content

fix(console): verify payment ownership before generating receipt URL #28396

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
PanAchy wants to merge 6 commits into
base: dev
Choose a base branch
from
+15 −0
Open

fix(console): verify payment ownership before generating receipt URL #28396

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ac008d8
fix(console): verify payment ownership before generating receipt URL
PanAchy May 19, 2026
0357f33
Merge branch 'dev' into fix/billing-receipt-url-idor
PanAchy May 19, 2026
8fcef25
Merge branch 'dev' into fix/billing-receipt-url-idor
PanAchy May 20, 2026
4c1f0cc
Merge branch 'dev' into fix/billing-receipt-url-idor
PanAchy May 21, 2026
e46a25b
Merge branch 'dev' into fix/billing-receipt-url-idor
PanAchy May 23, 2026
40a81ae
Merge branch 'dev' into fix/billing-receipt-url-idor
PanAchy Jun 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions packages/console/core/src/billing.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -457,6 +457,21 @@ export namespace Billing {
async (input) => {
const { paymentID } = input

const payment = await Database.use((tx) =>
tx
.select()
.from(PaymentTable)
.where(
and(
eq(PaymentTable.workspaceID, Actor.workspace()),
eq(PaymentTable.paymentID, paymentID),
isNull(PaymentTable.timeDeleted),
),
)
.then((rows) => rows[0]),
)
if (!payment) throw new Error("Payment not found")

const intent = await Billing.stripe().paymentIntents.retrieve(paymentID)
if (!intent.latest_charge) throw new Error("No charge found")

Expand Down
Loading