mirror of
https://github.com/Such-Software/wownerogue.git
synced 2026-10-18 22:58:32 +02:00
1) Double invoice: the "Buy Selected Package" button carries BOTH id=buy-credits-btn AND class=mode-option, so a click fired the generic .mode-option handler (no data attrs -> defaulted to single_game -> a spurious 1-credit invoice) AND its own buy-credits handler (the real pack). Guard the generic handler to ignore #buy-credits-btn and intentless clicks. 2) Smirk one-click payment never opened: /api/auth/smirk/status 403d, leaving _isLinked=false so onPaymentCreated skipped the Smirk path. The BOLA-hardened query matched socket_id AND anon_token, but socket_id is VOLATILE (changes every refresh) so it returned 0 rows after a reload. Match on the anon_token alone — the actual ownership secret — same protection, no refresh fragility.