@@ -15,6 +15,7 @@ import (
15
15
"code.gitea.io/gitea/modules/setting"
16
16
api "code.gitea.io/gitea/modules/structs"
17
17
"code.gitea.io/gitea/modules/util"
18
+ "code.gitea.io/gitea/modules/validation"
18
19
webhook_module "code.gitea.io/gitea/modules/webhook"
19
20
"code.gitea.io/gitea/services/context"
20
21
webhook_service "code.gitea.io/gitea/services/webhook"
@@ -92,6 +93,10 @@ func checkCreateHookOption(ctx *context.APIContext, form *api.CreateHookOption)
92
93
ctx .APIError (http .StatusUnprocessableEntity , "Invalid content type" )
93
94
return false
94
95
}
96
+ if ! validation .IsValidURL (form .Config ["url" ]) {
97
+ ctx .APIError (http .StatusUnprocessableEntity , "Invalid url" )
98
+ return false
99
+ }
95
100
return true
96
101
}
97
102
@@ -154,6 +159,41 @@ func pullHook(events []string, event string) bool {
154
159
return util .SliceContainsString (events , event , true ) || util .SliceContainsString (events , string (webhook_module .HookEventPullRequest ), true )
155
160
}
156
161
162
+ func updateHookEvents (events []string ) webhook_module.HookEvents {
163
+ if len (events ) == 0 {
164
+ events = []string {"push" }
165
+ }
166
+ hookEvents := make (webhook_module.HookEvents )
167
+ hookEvents [webhook_module .HookEventCreate ] = util .SliceContainsString (events , string (webhook_module .HookEventCreate ), true )
168
+ hookEvents [webhook_module .HookEventPush ] = util .SliceContainsString (events , string (webhook_module .HookEventPush ), true )
169
+ hookEvents [webhook_module .HookEventDelete ] = util .SliceContainsString (events , string (webhook_module .HookEventDelete ), true )
170
+ hookEvents [webhook_module .HookEventFork ] = util .SliceContainsString (events , string (webhook_module .HookEventFork ), true )
171
+ hookEvents [webhook_module .HookEventRepository ] = util .SliceContainsString (events , string (webhook_module .HookEventRepository ), true )
172
+ hookEvents [webhook_module .HookEventWiki ] = util .SliceContainsString (events , string (webhook_module .HookEventWiki ), true )
173
+ hookEvents [webhook_module .HookEventRelease ] = util .SliceContainsString (events , string (webhook_module .HookEventRelease ), true )
174
+ hookEvents [webhook_module .HookEventPackage ] = util .SliceContainsString (events , string (webhook_module .HookEventPackage ), true )
175
+ hookEvents [webhook_module .HookEventStatus ] = util .SliceContainsString (events , string (webhook_module .HookEventStatus ), true )
176
+ hookEvents [webhook_module .HookEventWorkflowJob ] = util .SliceContainsString (events , string (webhook_module .HookEventWorkflowJob ), true )
177
+
178
+ // Issues
179
+ hookEvents [webhook_module .HookEventIssues ] = issuesHook (events , "issues_only" )
180
+ hookEvents [webhook_module .HookEventIssueAssign ] = issuesHook (events , string (webhook_module .HookEventIssueAssign ))
181
+ hookEvents [webhook_module .HookEventIssueLabel ] = issuesHook (events , string (webhook_module .HookEventIssueLabel ))
182
+ hookEvents [webhook_module .HookEventIssueMilestone ] = issuesHook (events , string (webhook_module .HookEventIssueMilestone ))
183
+ hookEvents [webhook_module .HookEventIssueComment ] = issuesHook (events , string (webhook_module .HookEventIssueComment ))
184
+
185
+ // Pull requests
186
+ hookEvents [webhook_module .HookEventPullRequest ] = pullHook (events , "pull_request_only" )
187
+ hookEvents [webhook_module .HookEventPullRequestAssign ] = pullHook (events , string (webhook_module .HookEventPullRequestAssign ))
188
+ hookEvents [webhook_module .HookEventPullRequestLabel ] = pullHook (events , string (webhook_module .HookEventPullRequestLabel ))
189
+ hookEvents [webhook_module .HookEventPullRequestMilestone ] = pullHook (events , string (webhook_module .HookEventPullRequestMilestone ))
190
+ hookEvents [webhook_module .HookEventPullRequestComment ] = pullHook (events , string (webhook_module .HookEventPullRequestComment ))
191
+ hookEvents [webhook_module .HookEventPullRequestReview ] = pullHook (events , "pull_request_review" )
192
+ hookEvents [webhook_module .HookEventPullRequestReviewRequest ] = pullHook (events , string (webhook_module .HookEventPullRequestReviewRequest ))
193
+ hookEvents [webhook_module .HookEventPullRequestSync ] = pullHook (events , string (webhook_module .HookEventPullRequestSync ))
194
+ return hookEvents
195
+ }
196
+
157
197
// addHook add the hook specified by `form`, `ownerID` and `repoID`. If there is
158
198
// an error, write to `ctx` accordingly. Return (webhook, ok)
159
199
func addHook (ctx * context.APIContext , form * api.CreateHookOption , ownerID , repoID int64 ) (* webhook.Webhook , bool ) {
@@ -162,9 +202,6 @@ func addHook(ctx *context.APIContext, form *api.CreateHookOption, ownerID, repoI
162
202
return nil , false
163
203
}
164
204
165
- if len (form .Events ) == 0 {
166
- form .Events = []string {"push" }
167
- }
168
205
if form .Config ["is_system_webhook" ] != "" {
169
206
sw , err := strconv .ParseBool (form .Config ["is_system_webhook" ])
170
207
if err != nil {
@@ -183,31 +220,7 @@ func addHook(ctx *context.APIContext, form *api.CreateHookOption, ownerID, repoI
183
220
IsSystemWebhook : isSystemWebhook ,
184
221
HookEvent : & webhook_module.HookEvent {
185
222
ChooseEvents : true ,
186
- HookEvents : webhook_module.HookEvents {
187
- webhook_module .HookEventCreate : util .SliceContainsString (form .Events , string (webhook_module .HookEventCreate ), true ),
188
- webhook_module .HookEventDelete : util .SliceContainsString (form .Events , string (webhook_module .HookEventDelete ), true ),
189
- webhook_module .HookEventFork : util .SliceContainsString (form .Events , string (webhook_module .HookEventFork ), true ),
190
- webhook_module .HookEventIssues : issuesHook (form .Events , "issues_only" ),
191
- webhook_module .HookEventIssueAssign : issuesHook (form .Events , string (webhook_module .HookEventIssueAssign )),
192
- webhook_module .HookEventIssueLabel : issuesHook (form .Events , string (webhook_module .HookEventIssueLabel )),
193
- webhook_module .HookEventIssueMilestone : issuesHook (form .Events , string (webhook_module .HookEventIssueMilestone )),
194
- webhook_module .HookEventIssueComment : issuesHook (form .Events , string (webhook_module .HookEventIssueComment )),
195
- webhook_module .HookEventPush : util .SliceContainsString (form .Events , string (webhook_module .HookEventPush ), true ),
196
- webhook_module .HookEventPullRequest : pullHook (form .Events , "pull_request_only" ),
197
- webhook_module .HookEventPullRequestAssign : pullHook (form .Events , string (webhook_module .HookEventPullRequestAssign )),
198
- webhook_module .HookEventPullRequestLabel : pullHook (form .Events , string (webhook_module .HookEventPullRequestLabel )),
199
- webhook_module .HookEventPullRequestMilestone : pullHook (form .Events , string (webhook_module .HookEventPullRequestMilestone )),
200
- webhook_module .HookEventPullRequestComment : pullHook (form .Events , string (webhook_module .HookEventPullRequestComment )),
201
- webhook_module .HookEventPullRequestReview : pullHook (form .Events , "pull_request_review" ),
202
- webhook_module .HookEventPullRequestReviewRequest : pullHook (form .Events , string (webhook_module .HookEventPullRequestReviewRequest )),
203
- webhook_module .HookEventPullRequestSync : pullHook (form .Events , string (webhook_module .HookEventPullRequestSync )),
204
- webhook_module .HookEventWiki : util .SliceContainsString (form .Events , string (webhook_module .HookEventWiki ), true ),
205
- webhook_module .HookEventRepository : util .SliceContainsString (form .Events , string (webhook_module .HookEventRepository ), true ),
206
- webhook_module .HookEventRelease : util .SliceContainsString (form .Events , string (webhook_module .HookEventRelease ), true ),
207
- webhook_module .HookEventPackage : util .SliceContainsString (form .Events , string (webhook_module .HookEventPackage ), true ),
208
- webhook_module .HookEventStatus : util .SliceContainsString (form .Events , string (webhook_module .HookEventStatus ), true ),
209
- webhook_module .HookEventWorkflowJob : util .SliceContainsString (form .Events , string (webhook_module .HookEventWorkflowJob ), true ),
210
- },
223
+ HookEvents : updateHookEvents (form .Events ),
211
224
BranchFilter : form .BranchFilter ,
212
225
},
213
226
IsActive : form .Active ,
@@ -324,6 +337,10 @@ func EditRepoHook(ctx *context.APIContext, form *api.EditHookOption, hookID int6
324
337
func editHook (ctx * context.APIContext , form * api.EditHookOption , w * webhook.Webhook ) bool {
325
338
if form .Config != nil {
326
339
if url , ok := form .Config ["url" ]; ok {
340
+ if ! validation .IsValidURL (url ) {
341
+ ctx .APIError (http .StatusUnprocessableEntity , "Invalid url" )
342
+ return false
343
+ }
327
344
w .URL = url
328
345
}
329
346
if ct , ok := form .Config ["content_type" ]; ok {
@@ -352,19 +369,10 @@ func editHook(ctx *context.APIContext, form *api.EditHookOption, w *webhook.Webh
352
369
}
353
370
354
371
// Update events
355
- if len (form .Events ) == 0 {
356
- form .Events = []string {"push" }
357
- }
372
+ w .HookEvents = updateHookEvents (form .Events )
358
373
w .PushOnly = false
359
374
w .SendEverything = false
360
375
w .ChooseEvents = true
361
- w .HookEvents [webhook_module .HookEventCreate ] = util .SliceContainsString (form .Events , string (webhook_module .HookEventCreate ), true )
362
- w .HookEvents [webhook_module .HookEventPush ] = util .SliceContainsString (form .Events , string (webhook_module .HookEventPush ), true )
363
- w .HookEvents [webhook_module .HookEventDelete ] = util .SliceContainsString (form .Events , string (webhook_module .HookEventDelete ), true )
364
- w .HookEvents [webhook_module .HookEventFork ] = util .SliceContainsString (form .Events , string (webhook_module .HookEventFork ), true )
365
- w .HookEvents [webhook_module .HookEventRepository ] = util .SliceContainsString (form .Events , string (webhook_module .HookEventRepository ), true )
366
- w .HookEvents [webhook_module .HookEventWiki ] = util .SliceContainsString (form .Events , string (webhook_module .HookEventWiki ), true )
367
- w .HookEvents [webhook_module .HookEventRelease ] = util .SliceContainsString (form .Events , string (webhook_module .HookEventRelease ), true )
368
376
w .BranchFilter = form .BranchFilter
369
377
370
378
err := w .SetHeaderAuthorization (form .AuthorizationHeader )
@@ -373,23 +381,6 @@ func editHook(ctx *context.APIContext, form *api.EditHookOption, w *webhook.Webh
373
381
return false
374
382
}
375
383
376
- // Issues
377
- w .HookEvents [webhook_module .HookEventIssues ] = issuesHook (form .Events , "issues_only" )
378
- w .HookEvents [webhook_module .HookEventIssueAssign ] = issuesHook (form .Events , string (webhook_module .HookEventIssueAssign ))
379
- w .HookEvents [webhook_module .HookEventIssueLabel ] = issuesHook (form .Events , string (webhook_module .HookEventIssueLabel ))
380
- w .HookEvents [webhook_module .HookEventIssueMilestone ] = issuesHook (form .Events , string (webhook_module .HookEventIssueMilestone ))
381
- w .HookEvents [webhook_module .HookEventIssueComment ] = issuesHook (form .Events , string (webhook_module .HookEventIssueComment ))
382
-
383
- // Pull requests
384
- w .HookEvents [webhook_module .HookEventPullRequest ] = pullHook (form .Events , "pull_request_only" )
385
- w .HookEvents [webhook_module .HookEventPullRequestAssign ] = pullHook (form .Events , string (webhook_module .HookEventPullRequestAssign ))
386
- w .HookEvents [webhook_module .HookEventPullRequestLabel ] = pullHook (form .Events , string (webhook_module .HookEventPullRequestLabel ))
387
- w .HookEvents [webhook_module .HookEventPullRequestMilestone ] = pullHook (form .Events , string (webhook_module .HookEventPullRequestMilestone ))
388
- w .HookEvents [webhook_module .HookEventPullRequestComment ] = pullHook (form .Events , string (webhook_module .HookEventPullRequestComment ))
389
- w .HookEvents [webhook_module .HookEventPullRequestReview ] = pullHook (form .Events , "pull_request_review" )
390
- w .HookEvents [webhook_module .HookEventPullRequestReviewRequest ] = pullHook (form .Events , string (webhook_module .HookEventPullRequestReviewRequest ))
391
- w .HookEvents [webhook_module .HookEventPullRequestSync ] = pullHook (form .Events , string (webhook_module .HookEventPullRequestSync ))
392
-
393
384
if err := w .UpdateEvent (); err != nil {
394
385
ctx .APIErrorInternal (err )
395
386
return false
0 commit comments