Comments (4)
Hmm, must be something going wrong in https://github.com/guardian/gu-who/blob/666997a77e/app/lib/OrgUserProblems.scala#L80-L94 . Do you run gu-who frequently or manually every once in a while? There might be a bit of a race condition that gets exposed if gu-who runs are far apart.
Possibly we don't see this issue at the Guardian because we're running gu-who on an organisation webhook, so it gets run pretty frequently.
from gu-who.
There was a big gap indeed, we were trying to get access to some bot account that would be removed otherwise (and it was, correctly).
We plan to start running it regularly as cron job. Hook seems insecure to be honest - the token with owner privileges will be visible to all org members. Or am I missing something?
from gu-who.
There was a big gap indeed, we were trying to get access to some bot account that would be removed otherwise (and it was, correctly).
If you add the bot to a team called bots
the 2FA requirement will be waived, but the other two won't - I guess the full-name requirement could have got you there.
Hook seems insecure to be honest - the token with owner privileges will be visible to all org members.
The GitHub docs aren't very clear on this, but I believe it's just org owners who have access to the Settings
tab that org webhooks fall under - I tried viewing the webhook with a colleague's account and they were unable to see those settings.
from gu-who.
Yes, the full name
You're right about the hook, I thought it would be visible to all members. Easier than cron job indeed
from gu-who.
Related Issues (20)
- 403 trying to post directly to service - CSRF Error HOT 2
- Oops, an error occured HOT 5
- Document the "bots" and "2fa_disabled" groups HOT 2
- Runs this regularly on a server? HOT 4
- bot user and access token requirements HOT 8
- mention the grace period in the issues that are open HOT 2
- make grace period configurable HOT 2
- add a test mode HOT 2
- warning confuses when issue closed in same comment HOT 1
- Protect against stupid operators who didn't fill out a users.txt before running HOT 9
- Add deployment process in readme HOT 1
- Heroku request timeout HOT 4
- Allow anonymous users HOT 3
- The issue for each problematic user is added twice during one audit HOT 4
- Outside collaborators HOT 1
- Users allowed to sponsor themselves
- Hosted and self-hosted instances of gu-who appear to be broken?
- Check references to master
- Update other build configuration
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gu-who.