diff --git a/tools/WebhookProcessor/github_webhook_processor.php b/tools/WebhookProcessor/github_webhook_processor.php index 3f3802c4625..3cdc9342ed9 100644 --- a/tools/WebhookProcessor/github_webhook_processor.php +++ b/tools/WebhookProcessor/github_webhook_processor.php @@ -28,7 +28,8 @@ define('F_SECRET_PR', 1<<1); $hookSecret = '08ajh0qj93209qj90jfq932j32r'; $apiKey = '209ab8d879c0f987d06a09b9d879c0f987d06a09b9d8787d0a089c'; -$repoOwnerAndName = "tgstation/tgstation"; +$repoOwnerAndName = "tgstation/tgstation"; // this is just the repository auto-updates happen from +$repoAutoTaggerWhitelist = array("tgstation", "TerraGov-Marine-Corps"); $servers = array(); $enable_live_tracking = true; $path_to_script = 'tools/WebhookProcessor/github_webhook_processor.php'; @@ -209,6 +210,11 @@ function check_tag_and_replace($payload, $title_tag, $label, &$array_to_add_labe } function set_labels($payload, $labels, $remove) { + global $repoAutoTaggerWhitelist; + if(!in_array($repoAutoTaggerWhitelist, $payload['repository']['name'])) { + return; + } + $existing = get_labels($payload); $tags = array(); diff --git a/tools/WebhookProcessor/secret.php b/tools/WebhookProcessor/secret.php index 02dad3d6271..57773bffa16 100644 --- a/tools/WebhookProcessor/secret.php +++ b/tools/WebhookProcessor/secret.php @@ -10,9 +10,12 @@ $hookSecret = '08ajh0qj93209qj90jfq932j32r'; //This requires the public_repo (or repo for private repositories) and read:org permissions $apiKey = '209ab8d879c0f987d06a09b9d879c0f987d06a09b9d8787d0a089c'; -//Used to prevent potential RCEs +//The repository auto-updates are sourced from. $repoOwnerAndName = "tgstation/tgstation"; +//Whitelist of repository names that have PRs auto-tagged +$repoAutoTaggerWhitelist = array("tgstation", "TerraGov-Marine-Corps"); + //Auto update settings $enable_live_tracking = true; //auto update this file from the repository $path_to_script = 'tools/WebhookProcessor/github_webhook_processor.php';