Kyle Spier-Swenson 09a0f00456 Make the github webhook secret required for the webhook processor to avoid security issues ...

I already use this, but it occurred to me that without hooksecret, that somebody could craft a fake event with a "changelog" and a `$payload['pull_request']['base']['repo']['url']` set to a script they controlled, and use that to extract the private key.

2016-05-26 04:44:07 -07:00

12 KiB

Raw Blame History

View Raw