Hey there… I’m looking for some extra pairs of eyes on the plugin I’ve implemented for this feature: Allow Slack to unfurl/expand links to “login-required” Discourse instance Slack posts a request to yourdomain.com/slackdoor over https (assuming your site has it enabled) with an x-www-form-urlenc…

Hey there, I’m taking a look at your code now! Good work so far. I’ll have some feedback up tonight. As a heads-up, I’ll be working on an official Slack plugin (official as in sponsored by Discourse, not by Slack). It’s intended to be very fully-featured and go a bit deep. I don’t want to undermine …

Cool, thanks Nick. If this functionality is supported by the plugin you’re working on, I would be happy to switch over to something officially supported by the team. In the mean time, this is working well, but my main concern right now is whether I’m inadvertently introducing some risk security-wi…

Accepting incoming webhooks, that’s something I am interested. But it’ll be general. Pre-defined actions, some policy to process the webhooks. I probably will use that for testing webhooks among several Discourse instances. [圖片] mcwumbly: The request can’t include an API Key or username, but a …

I don’t see any major security problems I don’t think - but I am only looking at the obvious, myself. @fantasticfears covered some things I didn’t know myself. As long as the token they give is nice and cryptographically strong and HTTPS is being used, I think the bases are covered. It’d be nice…

Me is saying developing web application should consider authentication/authorization by all means. Rails.application.routes.recognize_path("/t/whatever/1234/56" The entry point in this case is a url. By forging a pair of topic_id/post_id, I could query any post where I want to see. I could know p…

The user configured in the SiteSettings can limit the exposure to private messages and staff categories. And the token configured in the SiteSetting had to match the one posted in the body. Does that address your concerns? Or do you think there is a gap somewhere still that I’m missing?

Sorry I missed the TopicView! :astonished: cc @Nick Sure that would do the authorization. And token configured on Slack end can be used as a certificate. HTTPS would prevent all kinds of passive attack.

Cool… Thanks so much for taking the time to go through this and give your feedback @fantasticfears . I’ll put some time into addressing your other code-cleanliness feedback and get a README together. That should put it in a state where others can use it while development gets underway for a more fu…

[圖片] fantasticfears: Sorry I missed the TopicView! :astonished: cc @Nick Hah. Glad :smile: Thought I missed something myself. All clear. [圖片] mcwumbly: @Nick , please feel free to use anything in here that you find useful, or reach out to me if you want feedback on the work you’re doing a…

Code review request for `slackdoor` plugin

Development

mcwumbly (Dave McClure) 2016年五月22日 20:33 11

The canonical plugin topic is now here: Discourse Slackdoor Plugin

話題		回覆	觀看
Allow Slack to unfurl/expand links to "login-required" Discourse instance Feature	5	5635	2016年五月22日
Slack command integration broken in official discourse slack plugin Support chat-integration	7	2813	2017年四月10日
Prevent Slack from unfurling anything for login-required sites Support	5	4060	2017年十二月2日
Help configuring Slack Discourse plugin Support	18	5013	2019年九月30日
Webhook Secret issue Support webhooks	12	1378	2023年八月21日

Code review request for `slackdoor` plugin

相關主題