-
-
Notifications
You must be signed in to change notification settings - Fork 3.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Integrations: Don't allow webhooks without a secret #11083
Conversation
This is just a clean up, we already deprecated the use of webhooks without a secret.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This PR looks good to me. I think we need to figure it out how to communicate to users they need to upgrade their webhook if they haven't done it yet, since we are removing that message in this PR.
We could create a notification and attach it to those projects that still have a webhook without a secret and "cancel" it once all their webhook are valid --or something around those lines.
missing_secret_for_pr_events_msg = dedent( | ||
""" | ||
This webhook doesn't have a secret configured. | ||
For security reasons, webhooks without a secret can't process pull/merge request events. | ||
For more information, read our blog post: https://blog.readthedocs.com/security-update-on-incoming-webhooks/. | ||
""" | ||
).strip() |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Are all the webhooks already migrated to those with a secret?
This message still seems useful to users that haven't migrated yet. If we remove it, how they will know they need to upgrade their integration?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We show a similar message now
readthedocs.org/readthedocs/api/v2/views/integrations.py
Lines 75 to 81 in ff7a3b7
missing_secret_deprecated_msg = dedent( | |
""" | |
This webhook doesn't have a secret configured. | |
For security reasons, webhooks without a secret are no longer permitted. | |
For more information, read our blog post: https://blog.readthedocs.com/security-update-on-incoming-webhooks/. | |
""" | |
).strip() |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The deleted message was to stop processing PR builds from integrations without a secret
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hrm, it seems that message is missing translation.
Suspect IssuesThis pull request was deployed and Sentry observed the following issues:
Did you find this useful? React with a 👍 or 👎 |
This is just a cleanup, we already deprecated the use of webhooks without a secret.