Comments (6)
You're going to need access to their code and know where to put it. I'm planning on having the incoming webhooks check your secret tokens soonish.
from heaven.
Secret tokens sounds good, but if someone exposes the secret than you're vulnerable. What about public github projects? Isn't it possible to just create public github repo and modify Capfile to do something bad (send HEROKU_API_KEY, DEPLOYMENT_PRIVATE_KEY to someone)? I think it would be better if new repositories were disabled by default and you needed to run something like heroku run heaven enable owner/repo
from heaven.
I'm working on bring this to hubot-deploy and it likely won't land in heaven.
from heaven.
Just wanted to chime in on this issue, I've made some changes to our heaven-fork that checks the secret token provided from the webhook. The code is in no way clean or tested, but if it stil interesting to get it merged into this repo I can put down an effort to make a PR.
from heaven.
@heim that'd be awesome
from heaven.
@atmos I'll put it on my list, guess I'll be able to do it over the weekend. Haven't done any Rails programming for a couple of years, but I guess it's just like learning to ride a bike. 🚲
from heaven.
Related Issues (20)
- Update provider libraries to download tarball vs cloning a git repository HOT 8
- Possible to use a different version of Ruby in bundler_capistrano? HOT 3
- Cannot Deploy to Heroku using web UI HOT 2
- Why DEPLOYMENT_PRIVATE_KEY don't take effect? HOT 2
- Remove formation size from app.json
- github oauth issue
- Heroku deploy button not working HOT 4
- 404 error page on "/resque" (after OAuth'ing with GitHub) HOT 3
- Archive downloads break deployments HOT 2
- Documentation question HOT 3
- Heaven installation HOT 2
- Elastic Beanstalk doesn't work! HOT 3
- Default value for GITHUB_TEAM_ID
- How to deploy private repository HOT 8
- A question on `github_authenticate` HOT 3
- How to host heaven on ubuntu14.04 instead of heroku HOT 8
- New payload for deployment statuses HOT 4
- DEPLOYMENT_PRIVATE_KEY doesn't get used HOT 4
- Heroku API Deprecation HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from heaven.