Repository navigation
Verify the webhook secret token of operator bots - #101
Merged
Merged
Conversation
The callback endpoint accepted any POST, so anyone who knows the URL could post fake updates on behalf of operators. Set webhook now registers a secret_token (derived from the bot token and the site secret hash) and the callback rejects requests whose X-Telegram-Bot-Api-Secret-Token header does not match. Webhooks set earlier (webhook_set = 1) keep working without the header until Set webhook is clicked again; the bot list shows them as "Yes (no secret token, set again)". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mysubcult
added a commit
to mysubcult/telegram
that referenced
this pull request
Oct 26, 2026
…perChat#98, LiveHelperChat#100, LiveHelperChat#101, LiveHelperChat#104 accepted upstream; fork already had them) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
telegram/callback/<bot id>accepts any POST request. Anyone who knows (or guesses) the URL can post a fake update with an operator's Telegram user id and act as that operator: write to visitors, press inline buttons, run bot commands.Telegram supports this case:
setWebhooktakes asecret_token, and every webhook request then carries it in theX-Telegram-Bot-Api-Secret-Tokenheader.Change
erLhcoreClassModelTelegramBot::$webhook_secretis derived from the bot id, the bot token and the sitesecrethash(HMAC-SHA256). No new column, no settings.secret_tokenand storeswebhook_set = 2.callback.phpreturns 403 whenwebhook_set = 2and the header is missing or wrong, and 404 for an unknown bot id (it used to fatal onnull).webhook_set = 1) keep working without the header. The bot list shows them as "Yes (no secret token, set again)", so admins know to click Set webhook once.webhook_setto 0, and the secret changes with the token.Testing
getWebhookInfostays OK, messages and button presses in topics keep working.curl -X POST .../telegram/callback/<id>without the header or with a wrong one gets 403.Note: with
modulecompileenabled, the cache has to be cleared after updating (php cron.php -s site_admin -c cron/util/clear_cache).🤖 Generated with Claude Code