mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-11-02 18:17:11 +09:00
Juan DenisandClaude Opus 5
47ec555915
The inbound gateway receiver is public by design — the HMAC signature IS the credential — but the reject branch read `if not signature_valid and signature_header`, so it only fired for a request that bothered to sign. A delivery with no `X-Hub-Signature-256` at all skipped the branch entirely and was logged, filtered and forwarded to the endpoint's `forward_url`. Every endpoint row carries a non-null secret, so there is no legitimate unsigned caller to preserve; the check is now unconditional and reports which of the two cases it refused. `preview_diff` joins a request-body `domain` straight onto SITES_AVAILABLE and returns the current file's contents inside the diff, which makes a traversing value an arbitrary file read. The guard lives in the service, not only in the route, so every future caller inherits it, and the route now surfaces the refusal as a 400 instead of handing the error dict back as a 200. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>