Coder Social home page Coder Social logo

Comments (12)

suzaku avatar suzaku commented on May 14, 2024 1

@linucksrox You may want to take a look at this document.

To prevent this type of exploitation from happening, starting with GitLab 10.6, all Webhook requests to the current GitLab instance server address and/or in a private network are forbidden by default. That means that all requests made to 127.0.0.1, ::1 and 0.0.0.0, as well as IPv4 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and IPv6 site-local (ffc0::/10) addresses aren’t allowed.

If it's the case for you, you can solve this problem by changing this behavior on GitLab Settings.

from bytebase.

tianzhou avatar tianzhou commented on May 14, 2024 1

Reopen this as we should also mention this directly in the product. Having Bytebase and GitLab in the same private network is a very likely setup.

from bytebase.

suzaku avatar suzaku commented on May 14, 2024 1

Yes, I think the error message should mention this. I can help with this.

from bytebase.

suzaku avatar suzaku commented on May 14, 2024 1

I have something different in mind. We should avoid overburden users with information in the happy-path UI, instead, we can show the tips in the error prompt when we know it's most useful the the user.

SGTM. BTW, if you also want to improve the backend error message. The code is around here https://github.com/bytebase/bytebase/blob/main/server/project.go#L191-L192

:) I know, already testing the change in my environment. The frontend environment seems to be broken, PTAL at #109

from bytebase.

suzaku avatar suzaku commented on May 14, 2024 1

@tianzhou Please assign this issue to me to avoid duplicate works on it.

from bytebase.

tianzhou avatar tianzhou commented on May 14, 2024

Thanks for the report, we will take a look and follow up soon.

from bytebase.

tianzhou avatar tianzhou commented on May 14, 2024

Unable to reproduce for now.

@linucksrox could you please provide your GitLab version?

Also could you please paste the message on the console after supplying the --debug option on startup https://docs.bytebase.com/reference/command-line#debug

from bytebase.

linucksrox avatar linucksrox commented on May 14, 2024

I tried again after enabling debug mode, and the output was this:
bytebase_bytebase.1.taax3az06lfg@docker181 | {"time":"2021-12-03T14:11:42Z","method":"POST","uri":"/api/project/101/repository","status":500,"error":"code=500, message=Failed to create webhook for project ID: 101, status code: 422"}

Thank you for pointing me in the right direction with the Gitlab webhook settings! I was able to get it working by checking "Allow requests to the local network from web hooks and services." and also adding the bytebase domain name in the allow list.

from bytebase.

tianzhou avatar tianzhou commented on May 14, 2024

Thanks @suzaku to point out the right direction. Add this to the troubleshoot guide https://docs.bytebase.com/use-bytebase/vcs-integration/troubleshoot#failed-to-create-webhook-xxx-status-code-422-for-gitlab

from bytebase.

tianzhou avatar tianzhou commented on May 14, 2024

@suzaku I am also thinking to include a note around here https://github.com/bytebase/bytebase/blob/main/frontend/src/components/RepositorySetupWizard.vue#L4

This message stays on the top during the entire VCS setup process.

from bytebase.

suzaku avatar suzaku commented on May 14, 2024

I have something different in mind.
We should avoid overburden users with information in the happy-path UI, instead, we can show the tips in the error prompt when we know it's most useful the the user.

from bytebase.

tianzhou avatar tianzhou commented on May 14, 2024

I have something different in mind. We should avoid overburden users with information in the happy-path UI, instead, we can show the tips in the error prompt when we know it's most useful the the user.

SGTM. BTW, if you also want to improve the backend error message. The code is around here https://github.com/bytebase/bytebase/blob/main/server/project.go#L191-L192

from bytebase.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    πŸ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. πŸ“ŠπŸ“ˆπŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❀️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.