hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Harden webhook API input

Browse source
This commit is contained in:
Lain Soykaf 2026-05-26 15:03:22 +04:00
commit ab634a4aa3
No known key found for this signature in database
3 changed files with 64 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/pleroma/web/admin_api/controllers/webhook_controller.ex
View file

@ -40,14 +40,14 @@ defmodule Pleroma.Web.AdminAPI.WebhookController do
end
def create(%{body_params: params} = conn, _) do
with {:ok, webhook} <- Webhook.create(params) do
with {:ok, webhook} <- Webhook.create(webhook_params(params)) do
render(conn, "show.json", webhook: webhook)
end
end
def update(%{body_params: params} = conn, %{id: id}) do
with %Webhook{internal: false} = webhook <- Webhook.get(id),
{:ok, webhook} <- Webhook.update(webhook, params) do
{:ok, webhook} <- Webhook.update(webhook, webhook_params(params)) do
render(conn, "show.json", webhook: webhook)
else
%Webhook{internal: true} -> {:error, :forbidden}
@ -94,4 +94,8 @@ defmodule Pleroma.Web.AdminAPI.WebhookController do
nil -> {:error, :not_found}
end
end
defp webhook_params(params) do
Map.drop(params, [:internal, "internal"])
end
end