pagure

#3569 Remove 'payload' from the webhook request's data.
Merged by pingou. Opened by cverna.
cverna/pagure fix_webhook_content  into  master

Download 3569.patch

By adding the 'payload' key to the request's data
we make it impossible to validate the hmac signature.

It is also making the request data not a valid json, since it is not calling json.dumps.

Signed-off-by: Clement Verna cverna@tutanota.com

hm, isn't this breaking backward compatibility?

hm, isn't this breaking backward compatibility?

The current status is that it is not possible to get the content of the request data. I tested with the following app and I am not able to get the JSON from the request.
I think this is because data={"payload": content} is not valid json.

Checking at the non celery webhook in pagure 3.9 we were only sending the content see 3.9 commit

I think payload was addded during pagure 4.0 development 4.0 commit 

From flask import Flask, request
app = Flask(__name__) 
@app.route('/webhook') 
def hello_world(): 
  print(f"Request JSON {request.json}")
  return 'Webhook notification' 
if __name__ == '__main__': 
  app.run(debug=True,host='0.0.0.0')

Odd...

Thanks for digging this up, I think your fix makes sense :)

Let's merge :)

rebased onto 3d798ec196b1c7214b9ad5cf0d663d99bc2972bc

Pull-Request has been merged by pingou
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.