Fringg 8175bc8bfe fix: comprehensive security hardening across payment and API layers ...

- CloudPayments: require webhook signature when secret configured (all 4 handlers)
- Platega: timing-safe HMAC comparison via hmac.compare_digest
- CryptoBot/Heleket: return False when API token unconfigured
- Tribute: return 503 when API key not configured
- Freekassa: use request.client.host instead of X-Forwarded-For
- Pal24: verify webhook amount matches stored payment amount
- YooKassa: reject test-mode payments in production; add YOOKASSA_TEST_MODE config
- CloudPayments: reject test-mode payments in production
- WebAPI: add upper bounds to duration_days, traffic_limit_gb, device_limit schemas
- WebAPI: bound balance update amount to ±100M kopeks
- WebAPI: sign-dispatch for balance updates (negative → subtract_user_balance)
- WebAPI miniapp: add blocked/deleted user checks, restriction_topup/subscription guards
- Admin handlers: add @admin_required and @error_handler to moderator panel
- add_user_balance: guard against negative amounts (use subtract_user_balance instead)

2026-03-23 16:44:38 +03:00

..

crud

fix: comprehensive security hardening across payment and API layers

2026-03-23 16:44:38 +03:00

__init__.py

refactor: replace universal_migration.py with Alembic

2026-02-18 08:10:20 +03:00

database.py

style: apply ruff formatting

2026-02-18 08:11:33 +03:00

migrations.py

fix: resolve alembic migration failures on fresh database install

2026-03-07 13:17:04 +03:00

models.py

feat: add managed news categories and tags with DB-backed CRUD

2026-03-23 15:29:21 +03:00