From cd06cafddf6e8119002084c60ec5561c26814688 Mon Sep 17 00:00:00 2001
From: ht <hikmet@texmart.com>
Date: Sun, 6 Sep 2026 17:47:26 +0300
Subject: [PATCH] validate Stripe checkout responses

---
 server/billing.mjs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/server/billing.mjs b/server/billing.mjs
index 89e729a..645fe91 100644
--- a/server/billing.mjs
+++ b/server/billing.mjs
@@ -188,6 +188,8 @@ export async function createCheckoutSession({ planId, email, periyot = 'yillik'
   });
   const data = await res.json().catch(() => ({}));
   if (!res.ok) throw new Error(data?.error?.message || `Stripe hatası: HTTP ${res.status}`);
+  if (typeof data.url !== 'string' || !/^https:\/\//.test(data.url) || typeof data.id !== 'string' || !data.id.trim())
+    throw new Error('Stripe checkout yanıtı geçersiz.');
   return { url: data.url, id: data.id };
 }