IntenseWebs/mattermost
3
0
Fork 0
mirror of https://github.com/mattermost/mattermost.git synced 2025-02-25 18:55:24 -06:00
Code Issues Packages Projects Releases Wiki Activity

MM-37691: Harden interactive dialog action (#22783)

Browse Source 
We strengthen some checks, forcing them to be changed
only via config.

https://mattermost.atlassian.net/browse/MM-37691

```release-note
NONE
```

Co-authored-by: Mattermost Build <build@mattermost.com>
This commit is contained in:
Agniva De Sarker 2023-05-04 15:08:55 +05:30 committed by GitHub
parent 3afd2ec549
commit efbee8ad56
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
server/channels/app/integration_action.go
View File

@ -332,7 +332,7 @@ func (a *App) DoActionRequest(c *request.Context, rawURL string, body []byte) (*
var httpClient *http.Client
subpath, _ := utils.GetSubpathFromConfig(a.Config())
siteURL, _ := url.Parse(*a.Config().ServiceSettings.SiteURL)
if (inURL.Hostname() == "localhost" || inURL.Hostname() == "127.0.0.1" || inURL.Hostname() == siteURL.Hostname()) && strings.HasPrefix(inURL.Path, path.Join(subpath, "plugins")) {
if inURL.Hostname() == siteURL.Hostname() && strings.HasPrefix(inURL.Path, path.Join(subpath, "plugins")) {
req.Header.Set(model.HeaderAuth, "Bearer "+c.Session().Token)
httpClient = a.HTTPService().MakeClient(true)
} else {

7
server/channels/app/integration_action_test.go
View File

@ -313,6 +313,13 @@ func TestPostAction(t *testing.T) {
attachmentsPlugin, ok := postplugin.GetProp("attachments").([]*model.SlackAttachment)
require.True(t, ok)
_, err = th.App.DoPostAction(th.Context, postplugin.Id, attachmentsPlugin[0].Actions[0].Id, th.BasicUser.Id, "")
require.Equal(t, "api.post.do_action.action_integration.app_error", err.Id)
th.App.UpdateConfig(func(cfg *model.Config) {
*cfg.ServiceSettings.AllowedUntrustedInternalConnections = "localhost,127.0.0.1"
})
_, err = th.App.DoPostAction(th.Context, postplugin.Id, attachmentsPlugin[0].Actions[0].Id, th.BasicUser.Id, "")
require.Nil(t, err)