Adds a configurable IP whitelist protection

README.md

@@ -14,9 +14,10 @@ cp config.yml.dist config.yml
 - **json**: The location of your *satis.json* file. Default: ```satis.json```.
 - **webroot**: The location of your satis webroot, where packages.json is going to be dumped. Default: ```web/```.
 - **user**: The location of your *bin/satis* file. This parameter is optional and default to ```null```.
+- **authorized_ips**: The IP address list allowed to access the page. This parameter is optional and default to the current GitHub hook servers (```[204.232.175.64/27, 192.30.252.0/22]```).
 
 Make your ```webhook.php``` file accessible, for example:
 
 ```
 http://satis.yourcompany.com/webhook.php
-```
+```

composer.json

@@ -1,6 +1,7 @@
 {
     "require": {
         "symfony/process": "~2.2.0",
-        "symfony/yaml": "~2.2.0"
+        "symfony/yaml": "~2.2.0",
+        "symfony/http-foundation": "~2.2.0"
     }
 }

config.yml.dist

@@ -2,3 +2,4 @@ bin: bin/satis   # Where your satis bin is located
 json: satis.json # Where your satis.json is located
 webroot: web     # Where you want to dump index.html and packages.json
 user: ~          # Run script as another user (sudo -u user -i bin/satis build ...)
+authorized_ips: [204.232.175.64/27, 192.30.252.0/22] # Authorized IP address (defaults are GitHub Hook servers). Use ~ if you want to allow all IPs

webhook.php

@@ -3,21 +3,47 @@
 
 use Symfony\Component\Process\Process;
 use Symfony\Component\Yaml\Yaml;
+use Symfony\Component\HttpFoundation\IpUtils;
+use \Symfony\Component\HttpFoundation\Request;
 
 if (!file_exists(__DIR__.'/config.yml')) {
     echo "Please, define your satis configuration in a config.yml file.\nYou can use the config.yml.dist as a template.";
     exit(-1);
 }
 
+$request = Request::createFromGlobals();
+
 $defaults = array(
     'bin' => 'bin/satis',
     'json' => 'satis.json',
     'webroot' => 'web/',
     'user' => null,
+    'authorized_ips' => null
 );
 $config = Yaml::parse(__DIR__.'/config.yml');
 $config = array_merge($defaults, $config);
 
+if (null !== $config['authorized_ips']) {
+    $ip = $request->getClientIp();
+    $authorized = false;
+
+    if (is_array($config['authorized_ips'])) {
+        foreach ($config['authorized_ips'] as $authorizedIp) {
+            $authorized = IpUtils::checkIp($ip, $authorizedIp);
+            if ($authorized) {
+                break;
+            }
+        }
+    } else {
+        $authorized = IpUtils::checkIp($ip, $config['authorized_ips']);
+    }
+
+    if (! $authorized) {
+        http_response_code(403);
+        exit(-1);
+    }
+}
+
 $errors = array();
 if (!file_exists($config['bin'])) {
     $errors[] = 'The Satis bin could not be found.';