bitcoin

core/bitcoin.coffee

@@ -2,13 +2,13 @@ request = require 'request'
 
 config = require './../config'
 
-exports.genAddress = (callback) ->
+exports.genAddress = (bitcoin_secret, callback) ->
   request 'https://coinbase.com/api/v1/account/generate_receive_address',
     method: 'POST'
     json:
       api_key: config.bitcoin.coinbase_api_key
       address:
-        callback_url: "#{config.web.url}/bitcoin/coinbase_callback"
+        callback_url: "#{config.web.url}/bitcoin/coinbase_callback?secret=#{bitcoin_secret}"
   , (err, res, body) ->
     callback body.address
 

core/model/account.coffee

@@ -28,6 +28,7 @@ sample =
 
   attribute:
     bitcoin_deposit_address: '13v2BTCMZMHg5v87susgg86HFZqXERuwUd'
+    bitcoin_secret: '53673f434686b535a6cec7b73a60ce045477f066f30eded55a9b972ccafddb2a'
 
     services: ['shadowsocks']
     plans: ['all']
@@ -80,8 +81,9 @@ exports.hashPassword = (password, password_salt) ->
 
 exports.register = (username, email, password, callback) ->
   password_salt = exports.randomSalt()
+  bitcoin_secret = exports.randomSalt()
 
-  bitcoin.genAddress (address) ->
+  bitcoin.genAddress bitcoin_secret, (address) ->
     exports.insert
       _id: new ObjectID()
       username: username
@@ -94,6 +96,7 @@ exports.register = (username, email, password, callback) ->
         avatar_url: "//ruby-china.org/avatar/#{crypto.createHash('md5').update(email).digest('hex')}?s=58"
       attribute:
         bitcoin_deposit_address: address
+        bitcoin_secret: bitcoin_secret
         services: []
         plans: []
         balance: 0

core/router/bitcoin.coffee

@@ -11,6 +11,9 @@ exports.post '/coinbase_callback', (req, res) ->
     unless account
       return res.send 400, 'Invalid Address'
 
+    unless req.query.secret == account.attribute.bitcoin_secret
+      return res.send 400, 'Invalid Secret'
+
     bitcoin.getExchangeRate (rate) ->
       amount = req.body.amount / rate