tdsds.com/gitea
1
1
Fork 0
mirror of https://github.com/go-gitea/gitea synced 2025-08-11 20:18:20 +00:00
Code Releases Activity

Only allow webhook to send requests to allowed hosts (#17482) (#17510)

Browse Source 
Backport #17482

* Only allow webhook to send requests to allowed hosts (backport #17482)

* use ALLOWED_HOST_LIST=* for default to keep the legacy behavior in 1.15.x
This commit is contained in:
wxiaoguang
2021-11-06 17:23:43 +08:00
committed by GitHub
parent 15b44496ec
commit 20ae184967
9 changed files with 285 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
custom/conf/app.example.ini
View File

@@ -1388,6 +1388,13 @@ PATH =
;; Deliver timeout in seconds
;DELIVER_TIMEOUT = 5
;;
;; Webhook can only call allowed hosts for security reasons. Comma separated list, eg: external, 192.168.1.0/24, *.mydomain.com
;; Built-in: loopback (for localhost), private (for LAN/intranet), external (for public hosts on internet), * (for all hosts)
;; CIDR list: 1.2.3.0/8, 2001:db8::/32
;; Wildcard hosts: *.mydomain.com, 192.168.100.*
;; Default to * for 1.15.x, external for 1.16 and later
;ALLOWED_HOST_LIST = *
;;
;; Allow insecure certification
;SKIP_TLS_VERIFY = false
;;