What the developer wrote
Authored by Nicolas Dorier
Remove confusing property
What changed, and why it matters
This commit removes an unused or redundant 'Id' property from a checkout view model in the Subscriptions plugin. The property was being set from a plan identifier but appears to have been 'confusing' rather than functional. There is no indication in the commit that this change fixes a security vulnerability.
No security action required. Treat as routine refactoring; verify that no view or script still references the removed Id property to avoid runtime errors.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch deletes the ‘Id’ string property from PlanCheckoutViewModel.cs and stops assigning ‘plan.Id’ to it in UIPlanCheckoutController.cs. The remaining view model still carries CheckoutId and other fields. No security boundary, authorization check, input validation, or output encoding behavior is changed. The diff is purely a code cleanup/refactoring change.
Changed components
BTCPayServer/Plugins/Subscriptions/Views/UIPlanCheckout/PlanCheckoutViewModel.csBTCPayServer/Plugins/Subscriptions/Controllers/UIPlanCheckoutController.csInspect captured patch +0 / −2
diff --git a/BTCPayServer/Plugins/Subscriptions/Controllers/UIPlanCheckoutController.cs b/BTCPayServer/Plugins/Subscriptions/Controllers/UIPlanCheckoutController.cs
index c337a4e..5de4789 100644
--- a/BTCPayServer/Plugins/Subscriptions/Controllers/UIPlanCheckoutController.cs
+++ b/BTCPayServer/Plugins/Subscriptions/Controllers/UIPlanCheckoutController.cs
@@ -41,7 +41,6 @@ public class UIPlanCheckoutController(
prefilledEmail = checkout.NewSubscriberEmail;
var vm = new PlanCheckoutViewModel()
{
- Id = plan.Id,
CheckoutId = checkoutId,
StoreBranding = await StoreBrandingViewModel.CreateAsync(Request, uriResolver, plan.Offering.App.StoreData.GetStoreBlob()),
StoreName = plan.Offering.App.StoreData.StoreName,
diff --git a/BTCPayServer/Plugins/Subscriptions/Views/UIPlanCheckout/PlanCheckoutViewModel.cs b/BTCPayServer/Plugins/Subscriptions/Views/UIPlanCheckout/PlanCheckoutViewModel.cs
index 6f79720..20d4047 100644
--- a/BTCPayServer/Plugins/Subscriptions/Views/UIPlanCheckout/PlanCheckoutViewModel.cs
+++ b/BTCPayServer/Plugins/Subscriptions/Views/UIPlanCheckout/PlanCheckoutViewModel.cs
@@ -10,7 +10,6 @@ public class PlanCheckoutViewModel
public string Title { get; set; }
public string StoreName { get; set; }
public string Email { get; set; }
- public string Id { get; set; }
public string CheckoutId { get; set; }
public PlanData Data { get; set; }
public bool IsPrefilled { get; set; }
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.