marty/instantadpay
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Public /api/config never exposes credential-like site settings; join page spacing

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
martbost
2026-09-10 08:04:19 -05:00
parent b7f2b3ef3f
commit e0d4bbc2e1
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/join.html
+1 -1
View File
@@ -26,7 +26,7 @@
.jn-chips span b{color:var(--mint);font-weight:700} .jn-chips span b{color:var(--mint);font-weight:700}
.jn-spon{display:flex;align-items:center;gap:10px;margin:0 0 6px} .jn-spon{display:flex;align-items:center;gap:10px;margin:0 0 6px}
.jn-spon img{width:34px;height:34px;border-radius:50%;object-fit:cover;border:1px solid var(--line-strong)} .jn-spon img{width:34px;height:34px;border-radius:50%;object-fit:cover;border:1px solid var(--line-strong)}
.jn-full{margin-top:44px} .jn-full{margin-top:26px}
.jn-h{display:flex;justify-content:space-between;align-items:baseline;gap:16px;flex-wrap:wrap;margin:0 0 14px} .jn-h{display:flex;justify-content:space-between;align-items:baseline;gap:16px;flex-wrap:wrap;margin:0 0 14px}
.jn-h h2{font-size:26px;margin:0} .jn-h h2{font-size:26px;margin:0}
.jn-h p{margin:0;font-size:14.5px} .jn-h p{margin:0;font-size:14.5px}
server.js
+4 -1
View File
@@ -516,9 +516,12 @@ const server = http.createServer(async (req, res) => {
// -- public API // -- public API
if (p === '/api/config' && req.method === 'GET') { if (p === '/api/config' && req.method === 'GET') {
const c = chain.getConfig(); const c = chain.getConfig();
// public copy of the site settings: never anything that looks like a credential
const pubSite = {};
for (const [k, v] of Object.entries(siteConfig())) if (!/secret|token|password|private|apikey|api_key/i.test(k)) pubSite[k] = v;
return json(res, 200, Object.assign({ contract: c.contract, chainId: c.chainId, return json(res, 200, Object.assign({ contract: c.contract, chainId: c.chainId,
chainName: c.chainName, explorer: c.explorer, rpc: c.rpcs[0], chainName: c.chainName, explorer: c.explorer, rpc: c.rpcs[0],
emailAuth: mailer.hasKey() || !IS_PROD }, siteConfig())); emailAuth: mailer.hasKey() || !IS_PROD }, pubSite));
} }
if (p === '/api/moonpay-url' && req.method === 'GET') { if (p === '/api/moonpay-url' && req.method === 'GET') {
// Card on-ramp deep link. With MoonPay keys set — PUBLIC key via // Card on-ramp deep link. With MoonPay keys set — PUBLIC key via