kangasbros / django-bitcoin

bitcoin payment management for django
MIT License
179 stars 107 forks source link

Security issue on running installations (fixed 2012-09-09) #17

Closed kangasbros closed 11 years ago

kangasbros commented 12 years ago

The BitcoinAddress -> Wallet m2m relation was causing some bitcoinaddresses to belong multiple wallets. This basically allow double spends for some edge cases. Should be problem only if you are runnign very big installation.

You can check your installation from django shell this way:

BitcoinAddress.objects.all() for ba in BitcoinAddress.objects.all(): if ba.wallet_set.count()>1: print [(w.id, w.total_balance()) for w in ba.wallet_set.all()]

If it doesn't output anything, you are good. Otherwise you have to go thourgh the cases manually.

The issue is fixed in current version on git, if you have south migrations then it should be pretty painless to upgrade. (The m2m relationship was changed to basic foreignkey relationship).