diff --git a/CHANGELOG.md b/CHANGELOG.md index 701678596..c0670abc8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,11 @@ +04.02.2020 +* Fixed bug that allowed bypassing blocked domain validation using punycode [#1142](https://github.com/internetee/registry/issues/1142) +* SimpleIDN gem update to 0.0.9 [#1508](https://github.com/internetee/registry/pull/1508) + +31.01.2020 +* Instant payments marks specific invoice as paid [#1500](https://github.com/internetee/registry/issues/1500) +* Sending invoice payment date to accounting [#1416](https://github.com/internetee/registry/issues/1416) + 29.01.2020 * Fixed the invoice binding bug where process failed if registrar tried to load a sum that they have used before [#1496](https://github.com/internetee/registry/issues/1496) diff --git a/Gemfile b/Gemfile index 26294b04e..b3882e792 100644 --- a/Gemfile +++ b/Gemfile @@ -37,7 +37,7 @@ gem 'grape' # registry specfic gem 'isikukood' # for EE-id validation -gem 'simpleidn', '0.0.7' # For punycode +gem 'simpleidn', '0.0.9' # For punycode gem 'money-rails' gem 'data_migrate' gem 'whenever', '0.9.4', require: false diff --git a/Gemfile.lock b/Gemfile.lock index 4dd4bd57c..23aa90a51 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -382,7 +382,7 @@ GEM json (>= 1.8, < 3) simplecov-html (~> 0.10.0) simplecov-html (0.10.2) - simpleidn (0.0.7) + simpleidn (0.0.9) sinatra (2.0.7) mustermann (~> 1.0) rack (~> 2.0) @@ -491,7 +491,7 @@ DEPENDENCIES select2-rails (= 3.5.9.3) selectize-rails (= 0.12.1) simplecov - simpleidn (= 0.0.7) + simpleidn (= 0.0.9) uglifier validates_email_format_of (= 1.6.3) webdrivers diff --git a/app/models/directo.rb b/app/models/directo.rb index 5f73a3f16..789db64b2 100644 --- a/app/models/directo.rb +++ b/app/models/directo.rb @@ -22,14 +22,16 @@ class Directo < ApplicationRecord counter += 1 num = invoice.number + paid_at = invoice.account_activity.bank_transaction&.paid_at&.strftime("%Y-%m-%d") mappers[num] = invoice xml.invoice( - "SalesAgent" => Setting.directo_sales_agent, - "Number" => num, - "InvoiceDate" => invoice.issue_date.strftime("%Y-%m-%d"), - "PaymentTerm" => Setting.directo_receipt_payment_term, - "Currency" => invoice.currency, - "CustomerCode"=> invoice.buyer.accounting_customer_code + "SalesAgent" => Setting.directo_sales_agent, + "Number" => num, + "InvoiceDate" => invoice.issue_date.strftime("%Y-%m-%d"), + 'TransactionDate' => paid_at, + "PaymentTerm" => Setting.directo_receipt_payment_term, + "Currency" => invoice.currency, + "CustomerCode"=> invoice.buyer.accounting_customer_code ){ xml.line( "ProductID" => Setting.directo_receipt_product_name, diff --git a/app/models/dns/domain_name.rb b/app/models/dns/domain_name.rb index d2ca9fa50..e4dd24fa5 100644 --- a/app/models/dns/domain_name.rb +++ b/app/models/dns/domain_name.rb @@ -60,7 +60,8 @@ module DNS end def blocked? - BlockedDomain.where(name: name).any? + BlockedDomain.where(name: name).any? || + BlockedDomain.where(name: SimpleIDN.to_unicode(name)).any? end def reserved? diff --git a/app/validators/domain_name_validator.rb b/app/validators/domain_name_validator.rb index 0d5638b37..2652c44d6 100644 --- a/app/validators/domain_name_validator.rb +++ b/app/validators/domain_name_validator.rb @@ -33,7 +33,9 @@ class DomainNameValidator < ActiveModel::EachValidator def validate_blocked(value) return true unless value - return false if BlockedDomain.where(name: value).count.positive? + return false if BlockedDomain.where(name: value).any? + return false if BlockedDomain.where(name: SimpleIDN.to_unicode(value)).any? + DNS::Zone.where(origin: value).count.zero? end end diff --git a/test/fixtures/blocked_domains.yml b/test/fixtures/blocked_domains.yml index 4bf0d0299..52c9beec2 100644 --- a/test/fixtures/blocked_domains.yml +++ b/test/fixtures/blocked_domains.yml @@ -1,2 +1,4 @@ one: name: blocked.test +idn: + name: blockedäöüõ.test diff --git a/test/integration/epp/domain/create/base_test.rb b/test/integration/epp/domain/create/base_test.rb index ff8da3696..ffd56ffc5 100644 --- a/test/integration/epp/domain/create/base_test.rb +++ b/test/integration/epp/domain/create/base_test.rb @@ -144,6 +144,36 @@ class EppDomainCreateBaseTest < EppTestCase assert_epp_response :data_management_policy_violation end + def test_blocked_punicode_domain_cannot_be_registered + blocked_domain = 'blockedäöüõ.test' + assert BlockedDomain.find_by(name: blocked_domain) + + request_xml = <<-XML + + + + + + #{SimpleIDN.to_ascii('blockedäöüõ.test')} + #{contacts(:john).code} + + + + + #{'test' * 2000} + + + + + XML + + assert_no_difference 'Domain.count' do + post epp_create_path, params: { frame: request_xml }, + headers: { 'HTTP_COOKIE' => 'session=api_bestnames' } + end + assert_epp_response :data_management_policy_violation + end + def test_reserved_domain_cannot_be_registered_with_wrong_registration_code request_xml = <<-XML diff --git a/test/models/directo_test.rb b/test/models/directo_test.rb new file mode 100644 index 000000000..9dbbf64d4 --- /dev/null +++ b/test/models/directo_test.rb @@ -0,0 +1,20 @@ +require 'test_helper' + +class DirectoTest < ActiveSupport::TestCase + setup do + @invoice = invoices(:one) + end + + def test_xml_is_include_transaction_date + @invoice.update(total: @invoice.account_activity.bank_transaction.sum) + @invoice.account_activity.bank_transaction.update(paid_at: Time.zone.now) + + stub_request(:post, ENV['directo_invoice_url']).with do |request| + request.body.include? 'TransactionDate' + end + + assert_nothing_raised do + Directo.send_receipts + end + end +end diff --git a/test/models/dns/domain_name_test.rb b/test/models/dns/domain_name_test.rb index 5d0dd5386..bd83076bc 100644 --- a/test/models/dns/domain_name_test.rb +++ b/test/models/dns/domain_name_test.rb @@ -131,7 +131,10 @@ class DNS::DomainNameTest < ActiveSupport::TestCase def test_blocked assert_equal 'blocked.test', blocked_domains(:one).name + assert_equal 'blockedäöüõ.test', blocked_domains(:idn).name assert DNS::DomainName.new('blocked.test').blocked? + assert DNS::DomainName.new('blockedäöüõ.test').blocked? + assert DNS::DomainName.new(SimpleIDN.to_ascii('blockedäöüõ.test')).blocked? assert_not DNS::DomainName.new('nonblocked .test').blocked? end