fix: Tier-2 mediums — input trims, confirmations, amount normalization

More robustness fixes from the audit (the import-key pattern, lower severity):

- Trim pasted input before use/validation: network add-server URL/label,
  lite-wallet key import (+ block empty), validate-address, address-book entry.
- Confirmations for destructive/irreversible actions:
  - Address-book Delete now needs a confirming second click (no undo).
  - Console `stop` needs a confirming second `stop` (it shuts down the node).
  - Wizard "Skip" encryption needs a confirming second click (keys stored
    unencrypted).
- Send amount: normalize to 8dp (satoshi precision) on both the DRGX and USD
  inputs so digits past 8dp aren't silently dropped between the preview/review
  and what's actually sent.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
2026-07-05 13:18:57 -05:00
parent 129a8e6449
commit 65bb98cd09
7 changed files with 75 additions and 20 deletions

View File

@@ -178,7 +178,13 @@ void RenderLiteNetworkTab(App* app)
ImGui::InputTextWithHint("##LiteAddLabel", TR("lite_net_add_label_hint"), s_addLabel, sizeof(s_addLabel));
ImGui::SameLine();
if (TactileButton(TR("lite_net_add"), ImVec2(addBtnW, 0))) {
std::string url = s_addUrl;
auto trimStr = [](std::string s) {
while (!s.empty() && (s.front()==' '||s.front()=='\t'||s.front()=='\n'||s.front()=='\r')) s.erase(s.begin());
while (!s.empty() && (s.back()==' '||s.back()=='\t'||s.back()=='\n'||s.back()=='\r')) s.pop_back();
return s;
};
std::string url = trimStr(s_addUrl);
std::string addLabel = trimStr(s_addLabel);
if (!wallet::isLiteServerUrlUsable(url)) {
s_addError = TR("lite_net_invalid_url");
} else {
@@ -188,7 +194,7 @@ void RenderLiteNetworkTab(App* app)
if (!exists) {
config::Settings::LiteServerPreference p;
p.url = url;
p.label = s_addLabel[0] ? std::string(s_addLabel) : url;
p.label = !addLabel.empty() ? addLabel : url;
p.enabled = true;
servers.push_back(p);
st->setLiteServers(servers);