Affiliate v5.0.5 - Critical Security & Stability Improvements

Release Date: January 17, 2025
Tags: CRITICAL FIXES, SECURITY IMPROVEMENTS, PERFORMANCE ENHANCEMENTS, BUG FIXES

Changed

Input validation

• Changed every affiliate endpoint to check and sanitise the values it is given, so a malformed request is refused consistently rather than handled differently depending on which endpoint received it.

Error handling

• Changed affiliate errors to be reported in terms a user can act on, with fallbacks when a subsystem is unavailable and an automatic retry for transient network failures.

Performance

• Changed network data operations to use less memory, cache frequently read data, pool database connections and run better queries, so large affiliate networks stay responsive.

---

Fixed

Backend

• Fixed a typo in the MLM referral condition list — "INVESTENT" where "INVESTMENT" was meant — which failed validation and prevented investment-based reward conditions from being created at all.
• Fixed reward transactions being processed without validation. Condition names, amounts and currencies are now checked for type and format before anything is processed, so a malformed transaction is rejected rather than acted on.
• Fixed a race condition that let the same reward be claimed twice. Claims are now locked at the database level and re-checked inside the transaction, and an already-claimed reward is reported as such.
• Fixed a percentage being applied twice in MLM reward calculations, which paid out more than configured. The condition reward and the level percentage are now applied separately, percentage and fixed reward types are handled distinctly, and binary and unilevel distribution is corrected.
• Fixed direct reward processing creating duplicate rewards, by checking for an existing reward against the same user and condition before creating one.
• Fixed unvalidated pagination allowing a request to exhaust server resources. The page number is capped at 1000 and the page size at 100, enforced on both the browser and the server, and an out-of-range request is refused with an error rather than attempted.

Frontend

• Fixed the affiliate dashboard rendering stale data and re-rendering endlessly, which also leaked memory over a long session.
• Fixed network data being corrupted when two requests overlapped. Requests are now de-duplicated and a request that hangs is abandoned after 10 seconds.
• Fixed memory accumulating in the dashboard from error states that were never cleared. The stored errors are now capped and cleaned up, and updates stop once the page has been left.
• Fixed the application freezing when the QR code was drawn for a referral link that was missing or invalid. An invalid link now shows a fallback, and a failed download is reported instead of being silent.
• Fixed a cross-site scripting hole in social sharing that allowed a malicious URL to be injected. Share targets are now checked against a list of permitted domains and the URL is properly encoded.

Security

• Fixed MLM settings being parsed without protection against hostile content. Settings are now limited to 5KB, screened for dangerous patterns, checked for a sane structure, and protected against prototype pollution.
• Fixed MLM referral registration running outside a database transaction, so a failure part-way through left records inconsistent. Registration is now transactional and rolls back cleanly, with locking for concurrent operations.

Stability

• Fixed the network visualisation processing an unlimited number of nodes, which could exhaust memory. Tree traversal is now capped at 10 levels and malformed network data is handled rather than followed.
• Fixed unhandled promise rejections while the admin network was being built, which could leave network data half-written after an interrupted operation.