Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fixed telegram respond issue #645

Merged
merged 1 commit into from
Oct 26, 2024
Merged

fixed telegram respond issue #645

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 9 additions & 6 deletions telegram/bot.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,14 +233,13 @@ def ensure_webhook(self):
"""
import requests

# Replace with your webhook and Telegram Bot token
webhook_url = "https://api.unitap.app/api/telegram/wh/"
telegram_api_url = (
f"https://api.telegram.org/bot{telebot_instance.token}/setWebhook"
)

# Register webhook with secret token for added security
requests.post(
res = requests.post(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue (bug_risk): The webhook registration response should be checked for errors to ensure proper setup

Consider validating the response status code and handling potential errors to prevent silent failures in webhook setup

telegram_api_url,
data={"url": webhook_url, "secret_token": settings.TELEGRAM_BOT_API_SECRET},
)
Expand All @@ -250,6 +249,10 @@ def ready(self):
Prepare the bot by registering the message and callback handlers for processing updates.
This is the setup function that connects Telegram message updates with handler functions.
"""
self.callback_handlers = register_callback_handlers()
self.message_handlers = register_message_handlers()
self.command_handlers = register_command_handlers()

telebot_instance.message_handler(func=lambda _: True)(
lambda message: self.on_telegram_message(message)
)
Expand Down Expand Up @@ -387,9 +390,9 @@ def handler(self, callback: types.CallbackQuery):

def register_message_handlers():
return {
subclass.callback: subclass(telebot_instance)
subclass.message: subclass(telebot_instance)
for subclass in BaseTelegramMessageHandler.__subclasses__()
if subclass.callback
if subclass.message
}


Expand All @@ -403,7 +406,7 @@ def register_callback_handlers():

def register_command_handlers():
return {
subclass.callback: subclass(telebot_instance)
subclass.command: subclass(telebot_instance)
for subclass in BaseTelegramCommandHandler.__subclasses__()
if subclass.callback
if subclass.command
}
2 changes: 0 additions & 2 deletions telegram/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,8 +46,6 @@ def telebot_respond(request):
# if client_ip not in telegram_ips:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 issue (security): IP validation should not be commented out as it reduces security defense in depth

While secret token validation provides security, IP validation adds an additional important security layer. Consider re-enabling it or documenting why it's disabled.

# raise PermissionDenied("Invalid IP address")

logger.info(request.headers)

if (
request.headers.get("X-Telegram-Bot-Api-Secret-Token")
!= settings.TELEGRAM_BOT_API_SECRET
Expand Down
Loading