iframe-proxy | Sunbelt Computer Software

This repository was archived by the owner on Apr 12, 2025. It is now read-only.
135 lines (119 loc) · 4.77 KB
 * Copyright Zikula - https://ziku.la/
 * For the full copyright and license information, please view the LICENSE
 * file that was distributed with this source code.
namespace Zikula\Module\CoreManagerModule\Controller;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
use Symfony\Component\Routing\Annotation\Route;
use Zikula\Core\Controller\AbstractController;
use Zikula\Core\Response\PlainResponse;
use Zikula\Module\CoreManagerModule\Exception\ClientException;
use Zikula\Module\CoreManagerModule\Exception\ServerException;
use Zikula\Module\CoreManagerModule\Manager\ReleaseManager;
use Zikula\Module\CoreManagerModule\Manager\PayloadManager;
 * GitHub webhook access point.
class WebHookController extends AbstractController
     * @Route("/webhook-core", methods = {"POST"}, options={"i18n"=false})
    public function core(Request $request)
        try {
            $payloadManager = new PayloadManager($request, true);
        } catch (\Exception $e) {
            return $this->handleException($e);
        $securityToken = $this->getVar('github_webhook_token');
        if (!empty($securityToken)) {
            $signature = $request->headers->get('X-Hub-Signature');
            if (empty($signature)) {
                return new PlainResponse('Missing security token!', Response::HTTP_BAD_REQUEST);
            $computedSignature = $this->computeSignature($payloadManager->getRawPayload(), $securityToken);
            if (!$this->secure_equals($computedSignature, $signature)) {
                return new PlainResponse('Signature did not match!', Response::HTTP_BAD_REQUEST);
        $event = $request->headers->get('X-Github-Event');
        if (empty($event)) {
            return new PlainResponse('"X-Github-Event" header is missing!', Response::HTTP_BAD_REQUEST);
        $useragent = $request->headers->get('User-Agent');
        if (strpos($useragent, 'GitHub-Hookshot/') !== 0) {
            // User agent does not match "GitHub-Hookshot/*"
            return new PlainResponse('User-Agent not allowed!', Response::HTTP_BAD_REQUEST);
        if ($event != 'release') {
            // We do not listen to that event.
            return new PlainResponse('Event ignored!', Response::HTTP_OK);
        $jsonPayload = $payloadManager->getJsonPayload();
        // See https://developer.github.com/v3/activity/events/types/#releaseevent
        if ('published' !== $jsonPayload['action']) {
            return new PlainResponse('Release event ignored (action != "published")!', Response::HTTP_OK);
        $repo = $this->getVar('github_core_repo', 'zikula/core');
        if ($jsonPayload['repository']['full_name'] != $repo) {
            return new PlainResponse('Release event ignored (repository != "' . $repo . '")!', Response::HTTP_BAD_REQUEST);
        /** @var ReleaseManager $releaseManager */
        $releaseManager = $this->get('zikula_core_manager_module.releasemanager');
        $releaseManager->updateGitHubRelease($jsonPayload['release']);
        return new PlainResponse('Release list reloaded!', Response::HTTP_OK);
     * Compute signature from payload using the security token.
     * @param $payload
     * @param $securityToken
     * @return string
    private function computeSignature($payload, $securityToken)
        return 'sha1=' . hash_hmac('sha1', $payload, $securityToken);
     * Compares two strings $a and $b in length-constant time.
     * @param $a
     * @param $b
     * @return bool
     * https://crackstation.net/hashing-security.htm#slowequals
    private function secure_equals($a, $b)
        $diff = strlen($a) ^ strlen($b);
        for($i = 0; $i < strlen($a) && $i < strlen($b); $i++) {
            $diff |= ord($a[$i]) ^ ord($b[$i]);
        return $diff === 0;
    private function handleException(\Exception $e)
        switch (true) {
            case $e instanceof ClientException:
                $text = $e->getMessage();
                $code = $e->getCode();
                break;
            case $e instanceof ServerException:
                $text = "Something went wrong at our server. Please report this issue.\n\n{$e->getMessage()}\n{$e->getTraceAsString()}";
                $code = $e->getCode();
                break;
            default:
                $text = "Something unexpected happend. Please report this issue.\n\n{$e->getMessage()}\n{$e->getTraceAsString()}";
                $code = Response::HTTP_INTERNAL_SERVER_ERROR;
        return new PlainResponse($text, $code);
Sunbelt Computer Software

PL/B Language Development and Support

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Sunbelt Computer Software

PL/B Language Development and Support

Uh oh!

FilesExpand file tree

WebHookController.php

Latest commit

History

WebHookController.php

File metadata and controls
