mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 10:47:18 +08:00
bb0934f5ab
When the patreon_webhook_secret site setting is blank, an attacker can forge valid webhook signatures by computing an HMAC-MD5 with an empty string as the key. Since the request body is known to the sender, the attacker can produce a matching signature and send arbitrary webhook payloads. This allows unauthorized creation, modification, or deletion of Patreon pledge data and triggering patron-to-group synchronization. The `secure_compare` change handles a very theoretical timing attack. |
||
|---|---|---|
| .. | ||
| fixtures | ||
| integration | ||
| jobs | ||
| lib | ||
| requests | ||
| system | ||
| spec_helper.rb | ||
