BTCPay Server

This commit introduces a new Greenfield (REST) Subscription API to BTCPay Server, allowing stores to manage subscription offerings, plans, subscribers, credits, and checkout sessions programmatically. It also refactors existing subscription internals, adds new permissions, and makes small related fixes such as handling empty URL paths and adding a null check for invoice IDs. There is no explicit security bug in the diff, but the large new attack surface and a few design choices warrant careful review.

This commit simply renames two permission strings from 'membership' to 'offerings' across the codebase. It is a non-functional refactor that updates labels, constants, authorization checks, and API documentation to match the new terminology. There is no security-relevant change.

This commit is a user-interface localization cleanup, not a security fix. It stops the system from automatically translating any button or link with the ID 'page-primary'. Instead, developers must now explicitly mark each primary button/link with a 'text-translate' attribute if they want it translated. The commit adds that attribute to many existing buttons and links so translations continue to work as intended. There is no security vulnerability here.

This commit is a straightforward internal rename from the word 'Entitlement' to the word 'Feature' across the new subscriptions/monetization plugin code. It changes class names, database table names, property names, method names, UI labels, and test helpers, but does not alter any security logic, access checks, or data handling behavior. There is no indication this fixes or introduces a security issue.

This is a large feature commit titled 'Monetization' that adds subscription and paid-access functionality to BTCPay Server. It introduces new plugins for monetization and subscriptions, changes how user login restrictions are enforced, adds a 'limited login' authentication scheme, and refactors user registration/invitation email flows. The changes touch authentication, authorization, billing, and user lifecycle logic. While the commit is framed as a feature, several areas have security implications: a new limited-login path that signs users in under a separate scheme when normal login is blocked, changes to password-reset and invitation-token handling, and new database entities for plans/subscribers/portal sessions. No explicit security bug is visible in the diff, but the breadth and sensitivity of the modified code means defects could have significant consequences.

This is a tiny one-line fix in a BTCPay Server web page that checks whether a user is allowed to set up certain types of cryptocurrency wallets. The old code referenced two properties that appear to have been renamed or replaced. The change simply swaps in the current property names so the page renders the wallet-setup section correctly. It is most likely a routine bug fix, but because it touches permission checks for wallet creation, it could have security-adjacent effects if the wrong users were shown (or hidden from) wallet options.

This commit fixes a UI bug where BTCPay Server was showing a 'Create a new wallet' button to users who did not have permission to create wallets. The button itself was just a link; the actual wallet creation endpoint still enforced permissions separately. So the fix is about hiding an option that shouldn't appear, not about blocking an unauthorized action. It is a defense-in-depth or user-experience security improvement rather than a critical vulnerability.

This commit fixes a simple but potentially important coding mistake: a constructor parameter named `loadAssembliesInDefaultLoadContext` was not being saved into its matching field. As a result, the plugin loader's intended setting about where to load assemblies was effectively ignored, and the code would fall back to the default value (false). This could change how plugins are isolated from the main application, potentially weakening the sandbox between plugins and the host.

This commit fixes a flaky automated test, not a security issue. The test previously checked the entire web page content for an email address, which could fail if the email appeared anywhere else on the page or if timing caused the page content to be incomplete. The change narrows the check to look specifically at the value of the email input field. There is no indication this affects real users or production code.

This commit is a routine test and code-quality improvement. It tightens a test helper that was incorrectly always setting IsAdmin to true, modernizes some C# syntax, removes unused imports, and adds test-id attributes to a web page so automated tests can locate elements more reliably. There is no security-relevant change to production behavior.

This commit removes an internal-only API client called LocalBTCPayClient. It was a convenience wrapper that let server code call BTCPay Server's own Greenfield API without making real HTTP requests. There is no indication this change fixes a security vulnerability; it appears to be a code cleanup or architectural simplification.

This commit refactors how BTCPay Server decides whether a user is allowed to log in. It replaces a simple built-in check with a new extensible system where plugins can add their own login-blocking rules. The change touches password logins, two-factor/FIDO2/LNURL logins, API key authentication, and basic HTTP authentication. It also fixes a small bug in basic authentication where the password was checked before the user was validated. There is no claim in the commit that this fixes a known security vulnerability, and no CVE or advisory is referenced.

This is a one-line user-interface styling fix in the main navigation menu. It adds a missing layout attribute so a menu link is styled consistently with other navigation items. There is no security relevance.

This commit is a code reorganization: it moves BTCPay Server's email-sending code from a shared 'Services/Mails' folder into the existing 'Plugins/Emails' plugin directory. File paths and namespace references are updated across the project, but the actual logic for sending email, validating settings, and checking certificates is copied almost unchanged. There is no indication this change fixes or introduces a security vulnerability.

This commit adds CC and BCC fields to BTCPay Server's email rules and refactors how email addresses are parsed. It is a feature addition, not a clear security fix. The new parsing logic uses a placeholder-replacement trick that could mask malformed addresses, and the validation is only partial, so there is a small chance of misdirected or failed emails. There is no evidence in the commit or supplied references that the vendor is treating this as a security issue.

This commit refactors BTCPay Server's email handling into a new 'Server Email Rules' plugin. It moves server and store email settings into shared base controllers, adds server-wide email rules (for example password-reset emails), and changes how password-reset emails are generated. The changes are mostly architectural and feature-adding; there is no clear evidence in the diff of a security vulnerability being fixed or introduced. However, the new code does involve email templating, SQL queries, and authorization boundaries, so it warrants normal review rather than being dismissed as purely cosmetic.

This is a large internal refactoring of how BTCPay Server's web UI tracks which navigation menu item is active. It replaces scattered, string-based helpers with a single LayoutModel and a new Razor tag helper. There is no obvious security vulnerability in the change; it is primarily code cleanup and test updates to match the new HTML IDs.

This is a large feature commit adding a new Subscriptions system to BTCPay Server. It introduces new database tables, models, UI pages, API permissions, webhooks, and business logic for managing subscription plans, subscribers, customer identities, checkouts, and portal sessions. There is no explicit security fix or vulnerability disclosure in the commit message or diff. The change is a feature addition, not a documented security patch.

This commit standardizes the wording and behavior of delete-confirmation dialogs across the BTCPay Server web interface. Previously, different screens asked users to type different words such as "DELETE" or "REMOVE" to confirm deletion. Now every confirmation prompt uses the same word, "Delete," and the check is case-insensitive. This is a user-experience and consistency improvement, not a fix for a security vulnerability.

This commit fixes a user-interface bug where a confirmation modal dialog would not close properly. The change removes an outer wrapper div that had Bootstrap CSS classes making the modal appear statically and always visible, which prevented the normal modal close behavior. There is no direct evidence in the commit of a security vulnerability such as cross-site scripting or request forgery.

This is a large refactoring commit that moves BTCPay Server's webhook and email-rule features into separate plugin areas and introduces a new database-backed email-rule system with JSONPath-based conditions. The changes are primarily structural: code is relocated, controllers are renamed, and a new TextTemplate helper is added for email interpolation. There is no explicit security fix or vulnerability disclosure in the commit message or diff, and no direct evidence of an exploitable bug is visible in the supplied materials.

This commit improves error messages shown to users when a Bitcoin transaction file (PSBT) cannot be signed because it is malformed or missing required data. It does not change the underlying signing rules; it only reports failures more clearly and redirects the user to an analysis view instead of attempting to sign an invalid PSBT. There is no direct evidence this fixes an exploitable vulnerability.

This commit changes a single translation string in BTCPay Server to include an error placeholder. It is a routine localization update with no security relevance visible in the diff.

This commit fixes a single-letter capitalization typo in the API documentation file. The property name 'feerate' was changed to 'feeRate' in a Swagger/OpenAPI JSON template so the documented field matches the actual API. There is no code behavior change and no security impact.

This commit is a purely cosmetic UI fix. It adjusts spacing around 'Date' column headers in several admin pages so the header text and a small date-format toggle button line up neatly. There is no security relevance.