Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Integrations: Don't allow webhooks without a secret #11083

Merged
merged 2 commits into from
Feb 1, 2024

Conversation

stsewd
Copy link
Member

@stsewd stsewd commented Jan 31, 2024

This is just a cleanup, we already deprecated the use of webhooks without a secret.

This is just a clean up, we already deprecated the use of webhooks without a secret.
@stsewd stsewd requested a review from a team as a code owner January 31, 2024 16:40
@stsewd stsewd requested a review from humitos January 31, 2024 16:40
Copy link
Member

@humitos humitos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR looks good to me. I think we need to figure it out how to communicate to users they need to upgrade their webhook if they haven't done it yet, since we are removing that message in this PR.

We could create a notification and attach it to those projects that still have a webhook without a secret and "cancel" it once all their webhook are valid --or something around those lines.

Comment on lines -77 to -83
missing_secret_for_pr_events_msg = dedent(
"""
This webhook doesn't have a secret configured.
For security reasons, webhooks without a secret can't process pull/merge request events.
For more information, read our blog post: https://blog.readthedocs.com/security-update-on-incoming-webhooks/.
"""
).strip()
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are all the webhooks already migrated to those with a secret?

This message still seems useful to users that haven't migrated yet. If we remove it, how they will know they need to upgrade their integration?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We show a similar message now

missing_secret_deprecated_msg = dedent(
"""
This webhook doesn't have a secret configured.
For security reasons, webhooks without a secret are no longer permitted.
For more information, read our blog post: https://blog.readthedocs.com/security-update-on-incoming-webhooks/.
"""
).strip()

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The deleted message was to stop processing PR builds from integrations without a secret

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hrm, it seems that message is missing translation.

@stsewd stsewd merged commit 0952cf9 into main Feb 1, 2024
7 checks passed
@stsewd stsewd deleted the dont-allow-webhooks-without-secret branch February 1, 2024 15:10
Copy link

sentry-io bot commented Feb 6, 2024

Suspect Issues

This pull request was deployed and Sentry observed the following issues:

  • ‼️ Integration.MultipleObjectsReturned: get() returned more than one Integration -- it returned 2! /api/v2/webhook/github/{project_slug}/ View Issue

Did you find this useful? React with a 👍 or 👎

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants