PetschStudios/KanbanGit
3
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases 24 Wiki Activity

Implement Discord webhook delivery #59

Merged
Twyco merged 3 commits from codex/v0.5-webhook-notification/05-discord-webhook-delivery into main 2026-04-24 16:50:18 +00:00
Conversation 2 Commits 3 Files Changed 6
+6
2 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit bd2355b7cd - Show all commits
app/Actions/Notifications/DeliverNotificationAction.php
+3
View File
@@ -272,6 +272,9 @@ class DeliverNotificationAction implements ShouldQueue
->timeout(10)
->post($notificationAction->delivery_url, [
'content' => $message,
Koda commented 2026-04-24 16:41:01 +00:00
Review
Copy Link
Copy Source

Should fix: Discord receives rendered ticket data from user-controlled fields ($ticket_title, $project_name, $actor_name) as raw content. Without allowed_mentions, values like @everyone / <@&role> will create real pings and enable mention-spam. Please include an explicit allowed_mentions policy (for example { "parse": [] }) or sanitize mention tokens before sending.

**Should fix:** Discord receives rendered ticket data from user-controlled fields (`$ticket_title`, `$project_name`, `$actor_name`) as raw `content`. Without `allowed_mentions`, values like `@everyone` / `<@&role>` will create real pings and enable mention-spam. Please include an explicit `allowed_mentions` policy (for example `{ "parse": [] }`) or sanitize mention tokens before sending.
'allowed_mentions' => [
'parse' => [],
],
]);
}
tests/Feature/Notifications/DeliverNotificationActionTest.php
+3
View File
@@ -89,6 +89,9 @@ class DeliverNotificationActionTest extends TestCase
&& $request->hasHeader('Content-Type', 'application/json')
&& $request->data() === [
'content' => 'CORE-42 moved from Backlog to Doing by Erica Example: https://kanbangit.test/projects/core/tickets/42 ($unknown)',
'allowed_mentions' => [
'parse' => [],
],
];
});