exchange

commit 43545e5e760213d1a3bc16e11275574654ba55a5
parent 225665769f6f7e3005856f3c5fec6875035d51eb
Author: Christian Grothoff <grothoff@gnunet.org>
Date:   Sun, 16 Aug 2026 08:38:45 +0200

add missing currency sanity chec

Diffstat:
M
src/exchange/taler-exchange-httpd_get-aml-OFFICER_PUB-transfers.c
 | 
11
+++++++++++
M
src/include/taler/taler_mhd_lib.h
 | 
4
++++

2 files changed, 15 insertions(+), 0 deletions(-)
diff --git a/src/exchange/taler-exchange-httpd_get-aml-OFFICER_PUB-transfers.c b/src/exchange/taler-exchange-httpd_get-aml-OFFICER_PUB-transfers.c
@@ -144,6 +144,17 @@ aml_transfer_get (
   TALER_MHD_parse_request_amount (rc->connection,
                                   "threshold",
                                   &threshold);
+  if (GNUNET_OK !=
+      TALER_amount_is_currency (&threshold,
+                                TEH_currency))
+  {
+    GNUNET_break_op (0);
+    return TALER_MHD_reply_with_error (
+      rc->connection,
+      MHD_HTTP_BAD_REQUEST,
+      TALER_EC_GENERIC_CURRENCY_MISMATCH,
+      "threshold");
+  }
   {
     json_t *transfers;
     enum GNUNET_DB_QueryStatus qs;
diff --git a/src/include/taler/taler_mhd_lib.h b/src/include/taler/taler_mhd_lib.h
@@ -764,6 +764,10 @@ TALER_MHD_parse_request_arg_snumber (struct MHD_Connection *connection,
 /**
  * Extract optional amount argument from request.
  *
+ * Note that the amount is parsed in any currency; the caller
+ * MUST check that the resulting currency is the one it expects
+ * (say using #TALER_amount_is_currency()) before using @a val.
+ *
  * @param connection the MHD connection
  * @param name name of the query parameter
  * @param[out] val set to the amount, unchanged if the