Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update webhook secret check

Browse Source
This commit is contained in:
Khushboo Verma
2023-09-06 22:34:03 +05:30
parent 0fbe9d6ce9
commit 39a4447103
1 changed files with 4 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/api/vcs.php
+4 -5
View File
@@ -783,15 +783,14 @@ App::post('/v1/vcs/github/events')
->inject('getProjectDB')
->action(
function (GitHub $github, Request $request, Response $response, Database $dbForConsole, callable $getProjectDB) use ($createGitDeployments) {
$signature = $request->getHeader('x-hub-signature-256', '');
$payload = $request->getRawPayload();
$signatureRemote = $request->getHeader('x-hub-signature-256', '');
$signatureLocal = App::getEnv('_APP_VCS_GITHUB_WEBHOOK_SECRET', '');
$signatureKey = App::getEnv('_APP_VCS_GITHUB_WEBHOOK_SECRET', '');
$valid = !empty($signatureKey) ? $github->validateWebhookEvent($payload, $signature, $signatureKey) : true;
$valid = empty($signatureRemote) ? true : $github->validateWebhookEvent($payload, $signatureRemote, $signatureLocal);
if (!$valid) {
throw new Exception(Exception::GENERAL_ACCESS_FORBIDDEN, "Invalid webhook signature.");
throw new Exception(Exception::GENERAL_ACCESS_FORBIDDEN, "Payload is not signed properly. Please make sure webhook secret has same value in GitHub app and in _APP_VCS_GITHUB_WEBHOOK_SECRET environment variable");
}
$event = $request->getHeader('x-github-event', '');