[fix]: various issues discovered during testing (#3002)

* fix: prevent invalid calls to exchange APIs
* fix: audit conditions
* fix: audit filtering

lnbits/middleware.py

@@ -134,8 +134,9 @@ class AuditMiddleware(BaseHTTPMiddleware):
             assert response
             return response
         finally:
-            duration = (datetime.now(timezone.utc) - start_time).total_seconds()
-            await self._log_audit(request, response, duration, request_details)
+            if request_details:
+                duration = (datetime.now(timezone.utc) - start_time).total_seconds()
+                await self._log_audit(request, response, duration, request_details)
 
     async def _log_audit(
         self,

lnbits/settings.py

@@ -695,12 +695,14 @@ class AuditSettings(LNbitsSettings):
                 if _re_fullmatch_safe(exclude_path, path):
                     return False
 
-        if len(self.lnbits_audit_include_paths) != 0:
-            if not path:
-                return False
-            for include_path in self.lnbits_audit_include_paths:
-                if _re_fullmatch_safe(include_path, path):
-                    return True
+        if len(self.lnbits_audit_include_paths) == 0:
+            return True
+
+        if not path:
+            return False
+        for include_path in self.lnbits_audit_include_paths:
+            if _re_fullmatch_safe(include_path, path):
+                return True
 
         return False
 

lnbits/static/js/base.js

@@ -357,6 +357,7 @@ window.LNbits = {
       }
     },
     prepareFilterQuery(tableConfig, props) {
+      tableConfig.filter = tableConfig.filter || {}
       if (props) {
         tableConfig.pagination = props.pagination
         Object.assign(tableConfig.filter, props.filter)

lnbits/utils/exchange_rates.py

@@ -176,7 +176,7 @@ currencies = {
 }
 
 
-def allowed_currencies():
+def allowed_currencies() -> list[str]:
     if len(settings.lnbits_allowed_currencies) > 0:
         return [
             item
@@ -187,6 +187,9 @@ def allowed_currencies():
 
 
 async def btc_rates(currency: str) -> list[tuple[str, float]]:
+    if currency.upper() not in allowed_currencies():
+        raise ValueError(f"Currency '{currency}' not allowed.")
+
     def replacements(ticker: str):
         return {
             "FROM": "BTC",