Comment 2 by Natalie Adams, Nov, 30 2014 9:34:04 PM
There is already this functionality provided by indefero. Background info: If you go to Project Management -> Source -> Webhook URL - basically this will allow you to call a web page to do something. I would be surprised if IFTTT doesn't support that - if not then it wouldn't be hard to write a page to call IFTTT with the right parameters. However - I just did some testing and this seems broken. It did reveal another problem that the post-commit hooks weren't running because www-data was being blocked from running the at command. I'll keep digging and update this ticket accordingly.
Status:
Started
Comment 3 by Natalie Adams, Nov, 30 2014 11:31:31 PM
I track the issue down to a cron job I didn't install but that's the easy problem. In Webhooks.php indefero is using fopen to send the web hook call. After some debugging the queuing system is getting stuck on that line - probably fopen is failing. I really don't know why they used fopen to make the HTTP call as curl is built into PHP. When I get some time I'll update it with curl calls.
Comment 4 by Natalie Adams, Dec, 10 2014 10:24:58 PM
Should be working now on a 5 minute check (at least for SVN -
haven't tested git/hg...going to create new tickets to test those).
Some sample code/output (assuming the URL points to this script):
<?php
$json = json_decode(file_get_contents('php://input'), true);
file_put_contents("/tmp/out.txt", print_r($json, true));
This will output:
Array
(
[project] => test-svn
[rev] => 18
[scm] => svn
[summary] => test POST COMMIT HOOK!!!
[fullmessage] =>
[author] => nadams
[creation_date] => 2014-12-11 04:09:43
)
Of course - you should verify the message by looking at the header
X-Web-Hook-Hmac and checking it using hash_hmac. While this doesn't
give you the URL for either the project page or commit view - you
can extrapolate those yourself. If there is high demand for it -
then I'll add it.
See this snippet from Webhook.php to give you an idea of how it's
signed ($data being the json encoded data):
$sign = hash_hmac('md5', $data, $payload['authkey']);
Now this exposes another issue - using MD5 signing. We could argue
about how insecure MD5 is - but the bottom line is 2 fold:
* This isn't a multi-billion dollar application that has highly
sensitive information
* Potential breaking of if anyone is expecting this behavior
Sometime in the near future I will add another header with a sha512
signing. And phase out the MD5 header several versions in the future.
Sign in to reply to this comment.
accountmanagementengine
Reported by austin j, Jul, 1 2014 4:39:39 PM