-
Notifications
You must be signed in to change notification settings - Fork 75
Open
Description
Reproduce:
- Submit an invoice with Year+Month more than 6 months back
- As a different user of same domain as invoice's line items (but not an admin), open Domain Invoices
Result: The new invoice is not visible to the reviewing domain peer, even though it has been created/edited very recently.
I *guess* the root cause is that invoice's Year and Month are used for the "6 months back" display filtering:
politeia/politeiawww/invoices.go
Line 1546 in cf6cd4c
| date := time.Date(int(inv.Input.Year), time.Month(inv.Input.Month), 0, 0, 0, 0, 0, time.UTC) |
If so, this allows to sneak in an invoice with an older month without domain peers noticing it.
A more bullet-proof behavior would be to use invoice's edited/modified timestamp for age filtering, since it is controlled by the server and not the user (unlike Year+Month).
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels