[fix] callback url validation (#2959)

lnbits/static/i18n/en.js

@@ -248,6 +248,10 @@ window.localisation.en = {
   allow_access_hint: 'Allow access by IP (will override blocked IPs)',
   enter_ip: 'Enter IP and hit enter',
   rate_limiter: 'Rate Limiter',
+  callback_url_rules: 'Callback URL Rules',
+  enter_callback_url_rule: 'Enter URL rule as regex and hit enter',
+  callback_url_rule_hint:
+    'Callback URLs (like LNURL one) will be validated against all of these rules. No rule means all URLs are allowed.',
   wallet_limiter: 'Wallet Limiter',
   wallet_config: 'Wallet Config',
   wallet_charts: 'Wallet Charts',

lnbits/static/js/admin.js

@@ -56,6 +56,7 @@ window.AdminPageLogic = {
       formAddExtensionsManifest: '',
       nostrNotificationIdentifier: '',
       formAllowedIPs: '',
+      formCallbackUrlRule: '',
       formBlockedIPs: '',
       nostrAcceptedUrl: '',
       formAddIncludePath: '',
@@ -331,6 +332,28 @@ window.AdminPageLogic = {
         b => b !== blocked_ip
       )
     },
+    addCallbackUrlRule() {
+      const allowedCallback = this.formCallbackUrlRule.trim()
+      const allowedCallbacks = this.formData.lnbits_callback_url_rules
+      if (
+        allowedCallback &&
+        allowedCallback.length &&
+        !allowedCallbacks.includes(allowedCallback)
+      ) {
+        this.formData.lnbits_callback_url_rules = [
+          ...allowedCallbacks,
+          allowedCallback
+        ]
+        this.formCallbackUrlRule = ''
+      }
+    },
+    removeCallbackUrlRule(allowedCallback) {
+      const allowedCallbacks = this.formData.lnbits_callback_url_rules
+      this.formData.lnbits_callback_url_rules = allowedCallbacks.filter(
+        a => a !== allowedCallback
+      )
+    },
+
     addNostrUrl() {
       const url = this.nostrAcceptedUrl.trim()
       this.removeNostrUrl(url)