mirror of
https://github.com/makeplane/plane.git
synced 2026-06-14 03:30:00 +00:00
sriram veeraghanta
761c999e0c
* fix: add WEBHOOK_ALLOWED_HOSTS allowlist for internal webhook targets The IP-based allowlist alone isn't practical for containerised deployments where service IPs are dynamic. Adds a hostname-based bypass for trusted internal services (e.g. Silo via docker-compose / k8s service DNS) and makes the previously hardcoded ["plane.so"] domain blocklist configurable via WEBHOOK_DISALLOWED_DOMAINS. - validate_url accepts allowed_hosts (exact, case-insensitive match; skips DNS lookup for trusted names) - WebhookSerializer wires both settings through and lets allowlisted hosts bypass the disallowed-domain check - Exposes WEBHOOK_ALLOWED_HOSTS in aio/cli deployment env files * fix: default WEBHOOK_DISALLOWED_DOMAINS to empty for self-hosted * fix: pass WEBHOOK_ALLOWED_HOSTS to send-time webhook re-validation
63 lines
1.5 KiB
Bash
63 lines
1.5 KiB
Bash
APP_DOMAIN=localhost
|
|
APP_RELEASE=stable
|
|
|
|
# If SSL Cert to be generated, set CERT_EMAIl="email <EMAIL_ADDRESS>"
|
|
CERT_EMAIL=
|
|
CERT_ACME_CA=https://acme-v02.api.letsencrypt.org/directory
|
|
|
|
SITE_ADDRESS=:80
|
|
|
|
# For DNS Challenge based certificate generation, set the CERT_ACME_DNS, CERT_EMAIL
|
|
# CERT_ACME_DNS="acme_dns <CERT_DNS_PROVIDER> <CERT_DNS_PROVIDER_API_KEY>"
|
|
CERT_ACME_DNS=
|
|
|
|
WEB_URL=http://localhost
|
|
DEBUG=0
|
|
CORS_ALLOWED_ORIGINS=http://localhost
|
|
API_BASE_URL=http://localhost:3004
|
|
|
|
#DB SETTINGS
|
|
DATABASE_URL=
|
|
|
|
# REDIS SETTINGS
|
|
REDIS_URL=
|
|
|
|
# RabbitMQ Settings
|
|
AMQP_URL=
|
|
|
|
# Secret Key
|
|
SECRET_KEY=60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b5
|
|
|
|
# DATA STORE SETTINGS
|
|
USE_MINIO=0
|
|
AWS_REGION=
|
|
AWS_ACCESS_KEY_ID=
|
|
AWS_SECRET_ACCESS_KEY=
|
|
AWS_S3_ENDPOINT_URL=https://s3.amazonaws.com
|
|
AWS_S3_BUCKET_NAME=
|
|
BUCKET_NAME=
|
|
FILE_SIZE_LIMIT=5242880
|
|
|
|
# Gunicorn Workers
|
|
GUNICORN_WORKERS=1
|
|
|
|
|
|
|
|
# Force HTTPS for handling SSL Termination
|
|
MINIO_ENDPOINT_SSL=0
|
|
|
|
# API key rate limit
|
|
API_KEY_RATE_LIMIT=60/minute
|
|
|
|
# Live Server Secret Key
|
|
LIVE_SERVER_SECRET_KEY=htbqvBJAgpm9bzvf3r4urJer0ENReatceh
|
|
|
|
# Webhook IP allowlist — comma-separated IPs or CIDR ranges allowed as webhook targets
|
|
# even if they resolve to private networks (e.g. "10.0.0.0/8,192.168.1.0/24,172.16.0.5")
|
|
WEBHOOK_ALLOWED_IPS=
|
|
|
|
# Webhook hostname allowlist — comma-separated hostnames that bypass the private-IP
|
|
# SSRF check. Useful for trusted internal services whose container/service IPs are
|
|
# dynamic (e.g. "silo,silo.namespace.svc.cluster.local")
|
|
WEBHOOK_ALLOWED_HOSTS=
|