Redmine

  menu_item :webhooks, :only => :webhooks

  def webhooks

    @webhooks = Webhook.eager_load(:user).order(*User.fields_for_order_statement, :url)

  end

  ADMIN_CUSTODY_ACTIONS = %w(edit update destroy).freeze

  helper_method :secret_hidden?

      redirect_back_or_default webhooks_path

      redirect_back_or_default webhooks_path

    redirect_back_or_default webhooks_path

  # True when the stored secret must not be disclosed to the current user

  def secret_hidden?

    @webhook&.persisted? && @webhook.user != User.current

  end

    attrs = params.require(:webhook).permit(:url, :secret, :active, events: [], project_ids: [])

    attrs.delete(:secret) if secret_hidden? && attrs[:secret].blank?

    attrs

    @webhook = editable_webhooks.find(params[:id])

  # Administrators may edit any webhook, without ever becoming its owner

  def editable_webhooks

    User.current.admin? ? Webhook.all : webhooks

  end

    return if Webhook.enabled?

    return if User.current.admin? && ADMIN_CUSTODY_ACTIONS.include?(action_name)

    render_403

    Project.visible(user).allowed_to(user, :use_webhooks).to_a

<% if Webhook.enabled? %>

<div class="contextual">

  <%= link_to sprite_icon('add', l(:label_webhook_new)), new_webhook_path(:back_url => admin_webhooks_path), class: 'icon icon-add' %>

</div>

<% end %>

<%= title l(:label_webhook_plural) %>

<% unless Webhook.enabled? %>

  <p class="warning"><%= t(:webhook_disabled_info_html, :link => link_to(l(:label_integrations), settings_path(:tab => 'integrations'))) %></p>

<% end %>

<%= render :partial => 'webhooks/list', :locals => { :webhooks => @webhooks, :show_author => true, :back_url => admin_webhooks_path } %>

      <% if secret_hidden? %>

        <p><label for="webhook_user"><%= l :field_user %></label><%= text_field_tag 'webhook_user', @webhook.user.name, disabled: true %></p>

      <% end %>

        <%= f.text_field :secret, :value => (secret_hidden? ? '' : @webhook.secret) %>

        <% if secret_hidden? %><em class="info"><%= l :webhook_secret_keep_info %></em><% end %>

<% if webhooks.any? %>

<div class="autoscroll">

<table class="list webhooks">

  <thead><tr>

    <% if show_author %><th><%= l :field_user %></th><% end %>

    <th><%= l :field_active %></th>

    <th><%= l :field_url %></th>

    <th><%= l :label_webhook_events %></th>

    <th><%= l :label_project_plural %></th>

    <th></th>

  </tr></thead>

  <tbody>

  <% webhooks.each do |webhook| %>

    <% link_params = back_url.present? ? {:back_url => back_url} : {} %>

    <tr id="webhook_<%= webhook.id %>" class="<%= cycle("odd", "even") %>">

      <% if show_author %><td><%= link_to_user webhook.user %></td><% end %>

      <td><%= webhook.active ? l(:general_text_Yes) : l(:general_text_No) %></td>

      <td title="<%= webhook.url %>"><%= truncate webhook.url, length: 40 %></td>

      <td><%= safe_join webhook.events.map{|e| content_tag :code, e }, ', ' %></td>

      <td><%= safe_join webhook.projects.visible.map{|p| link_to_project(p) }, ', ' %></td>

      <td class="buttons">

        <%= link_to sprite_icon('edit', l(:button_edit)), edit_webhook_path(webhook, link_params), class: 'icon icon-edit' %>

        <%= link_to sprite_icon('del', l(:button_delete)), webhook_path(webhook, link_params), :data => {:confirm => l(:text_are_you_sure)}, :method => :delete, :class => 'icon icon-del' %>

      </td>

    </tr>

  <% end %>

  </tbody>

</table>

</div>

<% else %>

  <p class="nodata"><%= l(:label_no_data) %></p>

<% end %>

  <%= back_url_hidden_field_tag %>

  <%= cancel_button_tag webhooks_path %>

<%= render :partial => 'webhooks/list', :locals => { :webhooks => @webhooks, :show_author => false, :back_url => nil } %>

  <%= back_url_hidden_field_tag %>

  <%= cancel_button_tag webhooks_path %>

  webhook_secret_keep_info: The secret of another user is not displayed. Leave this field blank to keep it unchanged.

  webhook_disabled_info_html: Webhooks are disabled, so none of the webhooks below is triggered. They are still listed here so that they can be reviewed or removed. Webhooks can be enabled in the %{link} settings.

  webhook_secret_keep_info: "Le secret d'un autre utilisateur n'est pas affiché. Laisser

    ce champ vide pour le conserver."

  webhook_disabled_info_html: "Les webhooks sont désactivés : aucun des webhooks ci-dessous

    n'est déclenché. Ils restent listés ici afin de pouvoir être examinés ou supprimés.

    Les webhooks peuvent être activés dans la configuration %{link}."

  get 'admin/webhooks', :to => 'admin#webhooks'

        menu.push :webhooks, {:controller => 'admin', :action => 'webhooks'},

                  :caption => :label_webhook_plural,

                  :icon => 'webhook',

                  :html => {:class => 'icon icon-webhook'}

  def test_webhooks

    hook = Webhook.create!(:url => 'https://example.com/dlopper/hook', :user => User.find_by_login('dlopper'),

                           :events => %w(issue.created), :projects => [Project.find(1)])

    other_hook = Webhook.create!(:url => 'https://example.com/admin/hook', :user => User.find(1),

                                 :events => %w(issue.updated), :projects => [Project.find(1)])

    with_settings :webhooks_enabled => '1' do

      get :webhooks

    end

    assert_response :success

    assert_select "tr#webhook_#{hook.id}" do

      assert_select 'td', :text => hook.user.name

      assert_select 'td', :text => hook.url

      assert_select "td.buttons a[href=?]", "/webhooks/#{hook.id}/edit?back_url=%2Fadmin%2Fwebhooks"

    end

    assert_select "tr#webhook_#{other_hook.id}"

    assert_select 'div.contextual a[href=?]', '/webhooks/new?back_url=%2Fadmin%2Fwebhooks'

  end

  def test_webhooks_should_remain_accessible_without_creation_link_when_disabled

    Webhook.create!(:url => 'https://example.com/dlopper/hook', :user => User.find_by_login('dlopper'),

                    :events => %w(issue.created), :projects => [Project.find(1)])

    with_settings :webhooks_enabled => '0' do

      get :webhooks

      assert_response :success

      assert_select 'table.webhooks tr[id^=?]', 'webhook_'

      assert_select 'div.contextual a', 0

      assert_select 'p.warning a[href=?]', '/settings?tab=integrations'

    end

  end

  def test_webhooks_should_be_denied_to_non_admin_users

    @request.session[:user_id] = 2

    get :webhooks

    assert_response :forbidden

  end

    assert_select 'em.info', text: I18n.t(:webhook_secret_keep_info), count: 0

  test 'index should not list hooks of other users to admins' do

    admin_hook = @other_hook

    dlopper_hook = @hook

    login_as_admin

    get :index

    assert_response :success

    assert_select 'td', text: admin_hook.url

    assert_select 'td', text: dlopper_hook.url, count: 0

  end

  test 'admin should edit hook of other user' do

    login_as_admin

    get :edit, params: { id: @hook.id }

    assert_response :success

    assert_select 'input#webhook_user[disabled][value=?]', @dlopper.name

  end

  test 'edit should not show the owner of ones own hook' do

    get :edit, params: { id: @hook.id }

    assert_response :success

    assert_select 'input#webhook_user', count: 0

  end

  test 'admin should update hook of other user without becoming its owner' do

    login_as_admin

    patch :update, params: { id: @hook.id, webhook: { url: 'https://example.com/fixed/hook' } }

    assert_redirected_to webhooks_path

    @hook.reload

    assert_equal 'https://example.com/fixed/hook', @hook.url

    assert_equal @dlopper, @hook.user

  end

  test 'admin should deactivate hook of other user' do

    @hook.update_column :active, true

    login_as_admin

    patch :update, params: { id: @hook.id, webhook: { active: '0' } }

    assert_not @hook.reload.active

  end

  test 'admin should destroy hook of other user' do

    login_as_admin

    assert_difference 'Webhook.count', -1 do

      delete :destroy, params: { id: @hook.id }

    end

  end

  test 'create should redirect to back_url' do

    post :create, params: { webhook: { url: 'https://example.com/new/hook', events: %w(issue.created), project_ids: [@project.id] }, back_url: '/admin/webhooks' }

    assert_redirected_to '/admin/webhooks'

  end

  test 'update should redirect to back_url' do

    login_as_admin

    patch :update, params: { id: @hook.id, webhook: { url: 'https://example.com/fixed/hook' }, back_url: '/admin/webhooks' }

    assert_redirected_to '/admin/webhooks'

  end

  test 'edit should not disclose secret of other user' do

    @hook.update_column :secret, 'v3rys3cret'

    login_as_admin

    get :edit, params: { id: @hook.id }

    assert_response :success

    assert_select 'input#webhook_secret'

    assert_not_include 'v3rys3cret', response.body

  end

  test 'update should keep secret of other user when submitted blank' do

    @hook.update_column :secret, 'v3rys3cret'

    login_as_admin

    patch :update, params: { id: @hook.id, webhook: { url: @hook.url, secret: '' } }

    assert_equal 'v3rys3cret', @hook.reload.secret

  end

  test 'update should replace secret of other user when a new one is submitted' do

    @hook.update_column :secret, 'v3rys3cret'

    login_as_admin

    patch :update, params: { id: @hook.id, webhook: { url: @hook.url, secret: 'newsecret' } }

    assert_equal 'newsecret', @hook.reload.secret

  end

  test 'owner should see and be able to clear their own secret' do

    @hook.update_column :secret, 'v3rys3cret'

    get :edit, params: { id: @hook.id }

    assert_select 'input#webhook_secret[value=?]', 'v3rys3cret'

    patch :update, params: { id: @hook.id, webhook: { url: @hook.url, secret: '' } }

    assert_equal '', @hook.reload.secret

  end

  test 'admin should keep access to existing hooks when disabled' do

    login_as_admin

    with_settings webhooks_enabled: '0' do

      get :edit, params: { id: @hook.id }

      assert_response :success

      patch :update, params: { id: @hook.id, webhook: { url: 'https://example.com/fixed/hook' } }

      assert_redirected_to webhooks_path

      assert_difference 'Webhook.count', -1 do

        delete :destroy, params: { id: @hook.id }

      end

    end

  end

  test 'admin should not create hooks when disabled' do

    login_as_admin

    with_settings webhooks_enabled: '0' do

      get :index

      assert_response :forbidden

      get :new

      assert_response :forbidden

    end

  end

  def login_as_admin

    @request.session[:user_id] = User.find_by_login('admin').id

  end

    should_route 'GET /admin/webhooks' => 'admin#webhooks'