diff options
| author | wxiaoguang <wxiaoguang@gmail.com> | 2021-11-01 16:39:52 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-11-01 16:39:52 +0800 |
| commit | 599ff1c054e436daa4dc3f049aa8661d9c2395f9 (patch) | |
| tree | 800983fd2e9d9de3dd1977738d18b64df34dd9ea /docs/content | |
| parent | 4e8a81780ed4ff0423e3a2ac7f75265e362ca46d (diff) | |
| download | gitea-599ff1c054e436daa4dc3f049aa8661d9c2395f9.tar.gz gitea-599ff1c054e436daa4dc3f049aa8661d9c2395f9.zip | |
Only allow webhook to send requests to allowed hosts (#17482)
Diffstat (limited to 'docs/content')
| -rw-r--r-- | docs/content/doc/advanced/config-cheat-sheet.en-us.md | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/docs/content/doc/advanced/config-cheat-sheet.en-us.md b/docs/content/doc/advanced/config-cheat-sheet.en-us.md index 91c62dbec3..6cc6043cae 100644 --- a/docs/content/doc/advanced/config-cheat-sheet.en-us.md +++ b/docs/content/doc/advanced/config-cheat-sheet.en-us.md @@ -581,6 +581,14 @@ Define allowed algorithms and their minimum key length (use -1 to disable a type - `QUEUE_LENGTH`: **1000**: Hook task queue length. Use caution when editing this value. - `DELIVER_TIMEOUT`: **5**: Delivery timeout (sec) for shooting webhooks. +- `ALLOWED_HOST_LIST`: **external**: Webhook can only call allowed hosts for security reasons. Comma separated list. + - Built-in networks: + - `loopback`: 127.0.0.0/8 for IPv4 and ::1/128 for IPv6, localhost is included. + - `private`: RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and RFC 4193 (FC00::/7). Also called LAN/Intranet. + - `external`: A valid non-private unicast IP, you can access all hosts on public internet. + - `*`: All hosts are allowed. + - CIDR list: `1.2.3.0/8` for IPv4 and `2001:db8::/32` for IPv6 + - Wildcard hosts: `*.mydomain.com`, `192.168.100.*` - `SKIP_TLS_VERIFY`: **false**: Allow insecure certification. - `PAGING_NUM`: **10**: Number of webhook history events that are shown in one page. - `PROXY_URL`: **\<empty\>**: Proxy server URL, support http://, https//, socks://, blank will follow environment http_proxy/https_proxy. If not given, will use global proxy setting. |