From dafb6eefccb979e09c4fd246820e66343542efb2 Mon Sep 17 00:00:00 2001
From: Jordan Dominion <Cyberboss@users.noreply.github.com>
Date: Sat, 10 Jun 2023 13:51:00 -0400
Subject: [PATCH] Add whitelist to webhook processor PR tagging (#75943)

I hate this script. Actions my beloved...

This is to get it away from my beautiful tgstation-server garden.

Fixes https://github.com/tgstation/tgstation-server/issues/1520
---
 tools/WebhookProcessor/github_webhook_processor.php | 8 +++++++-
 tools/WebhookProcessor/secret.php                   | 5 ++++-
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/tools/WebhookProcessor/github_webhook_processor.php b/tools/WebhookProcessor/github_webhook_processor.php
index 3f3802c4625..3cdc9342ed9 100644
--- a/tools/WebhookProcessor/github_webhook_processor.php
+++ b/tools/WebhookProcessor/github_webhook_processor.php
@@ -28,7 +28,8 @@ define('F_SECRET_PR', 1<<1);
 
 $hookSecret = '08ajh0qj93209qj90jfq932j32r';
 $apiKey = '209ab8d879c0f987d06a09b9d879c0f987d06a09b9d8787d0a089c';
-$repoOwnerAndName = "tgstation/tgstation";
+$repoOwnerAndName = "tgstation/tgstation"; // this is just the repository auto-updates happen from
+$repoAutoTaggerWhitelist = array("tgstation", "TerraGov-Marine-Corps");
 $servers = array();
 $enable_live_tracking = true;
 $path_to_script = 'tools/WebhookProcessor/github_webhook_processor.php';
@@ -209,6 +210,11 @@ function check_tag_and_replace($payload, $title_tag, $label, &$array_to_add_labe
 }
 
 function set_labels($payload, $labels, $remove) {
+	global $repoAutoTaggerWhitelist;
+	if(!in_array($repoAutoTaggerWhitelist, $payload['repository']['name'])) {
+		return;
+	}
+
 	$existing = get_labels($payload);
 	$tags = array();
 
diff --git a/tools/WebhookProcessor/secret.php b/tools/WebhookProcessor/secret.php
index 02dad3d6271..57773bffa16 100644
--- a/tools/WebhookProcessor/secret.php
+++ b/tools/WebhookProcessor/secret.php
@@ -10,9 +10,12 @@ $hookSecret = '08ajh0qj93209qj90jfq932j32r';
 //This requires the public_repo (or repo for private repositories) and read:org permissions
 $apiKey = '209ab8d879c0f987d06a09b9d879c0f987d06a09b9d8787d0a089c';
 
-//Used to prevent potential RCEs
+//The repository auto-updates are sourced from.
 $repoOwnerAndName = "tgstation/tgstation";
 
+//Whitelist of repository names that have PRs auto-tagged
+$repoAutoTaggerWhitelist = array("tgstation", "TerraGov-Marine-Corps");
+
 //Auto update settings
 $enable_live_tracking = true;	//auto update this file from the repository
 $path_to_script = 'tools/WebhookProcessor/github_webhook_processor.php';