Skip to content

RELEASE-20250309 #202

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alsgud8311 merged 5 commits into from
Mar 9, 2026
Merged

RELEASE-20250309 #202

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
fbc26b6
fix : 결제 기반 토스페이먼츠 키 관리 방식 추가
alsgud8311 Feb 23, 2026
84d1350
chore : add log for test
alsgud8311 Feb 24, 2026
f40f4b2
fix: add Toss Payments client key to environment variables for dev an…
alsgud8311 Feb 24, 2026
2e9fdba
fix : sitemap SEO improvement
alsgud8311 Mar 8, 2026
3d7d8ea
fix : token history display partial fix
alsgud8311 Mar 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/deploy-dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ jobs:
SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
NEXT_PUBLIC_CDN_BASE_URL=${{ secrets.DEV_CDN_BASE_URL }}
NEXT_PUBLIC_GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID_DEV }}
NEXT_PUBLIC_TOSS_PAYMENTS_CLIENT_KEY=${{ secrets.TOSS_PAYMENTS_CLIENT_KEY_DEV }}
NODE_ENV=production
NEXT_PUBLIC_BASE_URL=https://dev.kokomen.kr
NEXT_PUBLIC_API_BASE_URL=https://api-dev.kokomen.kr/api/v1
Expand Down Expand Up @@ -78,6 +79,7 @@ jobs:
echo "SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}" >> .env
echo "NEXT_PUBLIC_CDN_BASE_URL=${{ secrets.DEV_CDN_BASE_URL }}" >> .env
echo "NEXT_PUBLIC_GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID_DEV }}" >> .env
echo "NEXT_PUBLIC_TOSS_PAYMENTS_CLIENT_KEY=${{ secrets.TOSS_PAYMENTS_CLIENT_KEY_DEV }}" >> .env
echo "NODE_ENV=production" >> .env
echo "NEXT_PUBLIC_BASE_URL=https://dev.kokomen.kr" >> .env
echo "NEXT_PUBLIC_API_BASE_URL=https://api-dev.kokomen.kr/api/v1" >> .env
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ jobs:
SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
NEXT_PUBLIC_CDN_BASE_URL=${{ secrets.PROD_CDN_BASE_URL }}
NEXT_PUBLIC_GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID_PROD }}
NEXT_PUBLIC_TOSS_PAYMENTS_CLIENT_KEY=${{ secrets.TOSS_PAYMENTS_CLIENT_KEY_PROD }}
NODE_ENV=production
NEXT_PUBLIC_BASE_URL=https://kokomen.kr
NEXT_PUBLIC_API_BASE_URL=https://api.kokomen.kr/api/v1
Expand Down Expand Up @@ -78,6 +79,7 @@ jobs:
echo "SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}" >> .env
echo "NEXT_PUBLIC_CDN_BASE_URL=${{ secrets.PROD_CDN_BASE_URL }}" >> .env
echo "NEXT_PUBLIC_GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID_PROD }}" >> .env
echo "NEXT_PUBLIC_TOSS_PAYMENTS_CLIENT_KEY=${{ secrets.TOSS_PAYMENTS_CLIENT_KEY_PROD }}" >> .env
echo "NODE_ENV=production" >> .env
echo "NEXT_PUBLIC_BASE_URL=https://kokomen.kr" >> .env
echo "NEXT_PUBLIC_API_BASE_URL=https://api.kokomen.kr/api/v1" >> .env
Expand Down
1 change: 1 addition & 0 deletions apps/client/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ ARG NEXT_PUBLIC_POSTHOG_KEY
ARG NEXT_PUBLIC_POSTHOG_HOST
ARG NEXT_PUBLIC_CDN_BASE_URL
ARG NEXT_PUBLIC_GOOGLE_CLIENT_ID
ARG NEXT_PUBLIC_TOSS_PAYMENTS_CLIENT_KEY
ARG SENTRY_AUTH_TOKEN
ARG NODE_ENV

Expand Down
1 change: 1 addition & 0 deletions apps/client/env.d.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,5 +13,6 @@ declare const process: {
NEXT_PUBLIC_V3_API_BASE_URL: string;
NEXT_PUBLIC_CDN_BASE_URL: string;
NEXT_PUBLIC_GOOGLE_CLIENT_ID: string;
NEXT_PUBLIC_TOSS_PAYMENTS_CLIENT_KEY: string;
};
};
2 changes: 1 addition & 1 deletion apps/client/src/domains/purchase/components/PurchaseSection.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@ function PurchaseMode({
useEffect(() => {
const fetchTossPayments = async () => {
const tossPayments = await loadTossPayments(
"test_gck_docs_Ovk5rk1EwkEbP0W43n07xlzm"
(process.env.NEXT_PUBLIC_TOSS_PAYMENTS_CLIENT_KEY as string) || ""
);
const widgets = tossPayments.widgets({
customerKey: ANONYMOUS
Expand Down
16 changes: 14 additions & 2 deletions apps/client/src/pages/server-sitemap.xml/index.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,22 @@
import { getServerSideSitemapIndexLegacy } from "next-sitemap";
import { GetServerSideProps } from "next";
import { getPaginatedRankList } from "@/domains/members/api";

const MAX_RANK_COUNT = 100000;

export const getServerSideProps: GetServerSideProps = async (ctx) => {
const rankList = await getPaginatedRankList(0, MAX_RANK_COUNT).then(
(res) => res.data
);
Comment on lines +5 to +10
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

The getServerSideProps function fetches up to 100,000 rank items from the backend API in a single request. This operation is triggered every time the /server-sitemap.xml endpoint is accessed. Fetching and processing such a large volume of data (potentially several megabytes of JSON) can lead to significant resource exhaustion (CPU, memory, and network bandwidth) on both the Next.js server and the backend API. An attacker or even a search engine crawler could cause a Denial of Service (DoS) by repeatedly requesting this URL.


const memberSitemaps = rankList.map(
(rank) =>
`${process.env.NEXT_PUBLIC_BASE_URL}/members/${rank.id}/sitemap.xml`
);

return getServerSideSitemapIndexLegacy(ctx, [
`${process.env.NEXT_PUBLIC_BASE_URL}/sitemap/members.xml`,
`${process.env.NEXT_PUBLIC_BASE_URL}/sitemap/rank.xml`
`${process.env.NEXT_PUBLIC_BASE_URL}/sitemap/rank.xml`,
...memberSitemaps
]);
};

Expand Down
19 changes: 0 additions & 19 deletions apps/client/src/pages/sitemap/members.xml.tsx
View file
Open in desktop

This file was deleted.

4 changes: 1 addition & 3 deletions packages/ui/src/components/domains/purchase/tokenHistory.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,7 @@ export default function TokenHistory({
</div>
<div className="text-start">
<div className="text-lg font-bold">{orderName}</div>
<span>
{remainingCount ? `${remainingCount}개 사용가능` : "사용완료"}
</span>
<span>{state}</span>
</div>
</div>
<div className="flex gap-4 text-text-description items-center">
Expand Down