Webhook for "Issue Comment" contains no secret #2208

New Issue

GiteaMirror · 2025-11-02T04:27:13-06:00

GiteaMirror commented

2025-11-02 04:27:13 -06:00

Originally created by @maltehol on GitHub (Aug 16, 2018).

Gitea version (or commit ref): 1.5
Git version: 2.1.4
Operating system: Raspbian
Database (use [x]):
- PostgreSQL
- MySQL (MariaDB)
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL)
- No
- Not relevant
Log gist:

Description

When setting up webhooks in gitea, I expect that every hook uses the secret one chooses.
But for issue_comment there is no secret field in the json which is send out.

The send json:

{
  "action": "created",
  "issue": {
    "id": 23,
    "url": "<url>",
    "number": 11,
    "user": {
      // User Object
    },
    "title": "123",
    "body": "",
    "labels": [],
    "milestone": null,
    "assignee": null,
    "assignees": null,
    "state": "open",
    "comments": 0,
    "created_at": "2018-08-13T08:39:29Z",
    "updated_at": "2018-08-16T16:44:36Z",
    "closed_at": null,
    "due_date": null,
    "pull_request": null
  },
  "comment": {
    "id": 42,
    "html_url": "<html_url>",
    "pull_request_url": "",
    "issue_url": "<issue_url>",
    "user": {
      // User object
    },
    "body": "No secret?",
    "created_at": "2018-08-16T16:44:36Z",
    "updated_at": "2018-08-16T16:44:36Z"
  },
  "repository": {
    "id": 6,
    "owner": {
      // User object
    },
    "name": "hook-test",
    "full_name": "mh/hook-test",
    "description": "",
    "empty": false,
    "private": true,
    "fork": false,
    "parent": null,
    "mirror": false,
    "size": 128,
    "html_url": "<html_url>",
    "ssh_url": "<ssh_url>",
    "clone_url": "<clone_url>",
    "website": "",
    "stars_count": 0,
    "forks_count": 0,
    "watchers_count": 1,
    "open_issues_count": 7,
    "default_branch": "master",
    "created_at": "2018-08-12T09:50:19Z",
    "updated_at": "2018-08-13T10:59:50Z",
    "permissions": {
      "admin": true,
      "push": true,
      "pull": true
    }
  },
  "sender": {
    // User object
  }
}

To reproduce:

Create a webhook in gitea, choose "Custom Events...." -> "Issue Comment"
Add a comment to a arbitrary issue in that repo
Edit the webhook and look at "Recent Deliveries"

Originally created by @maltehol on GitHub (Aug 16, 2018).  - Gitea version (or commit ref): 1.5 - Git version: 2.1.4 - Operating system: Raspbian - Database (use `[x]`): - [ ] PostgreSQL - [x] MySQL (MariaDB) - [ ] MSSQL - [ ] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [ ] No - [x] Not relevant - Log gist: ## Description When setting up webhooks in gitea, I expect that every hook uses the secret one chooses. But for `issue_comment` there is no `secret` field in the json which is send out. The send json: ```json { "action": "created", "issue": { "id": 23, "url": "<url>", "number": 11, "user": { // User Object }, "title": "123", "body": "", "labels": [], "milestone": null, "assignee": null, "assignees": null, "state": "open", "comments": 0, "created_at": "2018-08-13T08:39:29Z", "updated_at": "2018-08-16T16:44:36Z", "closed_at": null, "due_date": null, "pull_request": null }, "comment": { "id": 42, "html_url": "<html_url>", "pull_request_url": "", "issue_url": "<issue_url>", "user": { // User object }, "body": "No secret?", "created_at": "2018-08-16T16:44:36Z", "updated_at": "2018-08-16T16:44:36Z" }, "repository": { "id": 6, "owner": { // User object }, "name": "hook-test", "full_name": "mh/hook-test", "description": "", "empty": false, "private": true, "fork": false, "parent": null, "mirror": false, "size": 128, "html_url": "<html_url>", "ssh_url": "<ssh_url>", "clone_url": "<clone_url>", "website": "", "stars_count": 0, "forks_count": 0, "watchers_count": 1, "open_issues_count": 7, "default_branch": "master", "created_at": "2018-08-12T09:50:19Z", "updated_at": "2018-08-13T10:59:50Z", "permissions": { "admin": true, "push": true, "pull": true } }, "sender": { // User object } } ``` To reproduce: * Create a webhook in gitea, choose "Custom Events...." -> "Issue Comment" * Add a comment to a arbitrary issue in that repo * Edit the webhook and look at "Recent Deliveries"

GiteaMirror added the type/bug label 2025-11-02 04:27:13 -06:00

GiteaMirror closed this issue

2025-11-02 04:27:13 -06:00

GiteaMirror commented

2025-11-02 04:27:14 -06:00

@OvermindDL1 commented on GitHub (Sep 10, 2018):

Confirmed issue still exists as of commit bd1bf2a072.

@OvermindDL1 commented on GitHub (Sep 10, 2018): Confirmed issue still exists as of commit bd1bf2a0720b771cfe2fac3fef0fd9edd68f6317.

GiteaMirror commented

2025-11-02 04:27:15 -06:00

@adelowo commented on GitHub (Sep 10, 2018):

Would take a look at this tomorrow