Repository navigation
feat(notifier): canal Nextcloud Talk pour les alertes - #101
Conversation
Compte dédié + mot de passe d'application + jeton de conversation, lus dans .env (NEXTCLOUD_URL/USER/PASSWORD/TALK_TOKEN, gabarit dans .env.example). Aucun secret dans le code ni dans les logs. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| logger.warning(f"telegram: envoi impossible ({type(e).__name__})") | ||
|
|
||
| if all(os.getenv(v) for v in _NEXTCLOUD_VARS): | ||
| base = os.environ["NEXTCLOUD_URL"].rstrip("/") |
There was a problem hiding this comment.
SUGGESTION: No HTTPS guard before sending Basic auth
base comes straight from NEXTCLOUD_URL and is used as the target of the auth=(user, password) POST. If the URL is ever configured as http://... (self-hosted behind a reverse proxy, a typo, a LAN address), the app password travels base64-encoded in cleartext on every watchdog alert. The other channels hardcode https:// hosts, so nothing else in the file constrains the scheme here. A cheap guard is to log/skip (or at least warn loudly) when the parsed scheme is not https, which also turns a silent misconfiguration into a visible one.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Incremental review of Files Reviewed (2 files)
Previous Review Summary (commit d774d9b)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit d774d9b)Status: 1 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)SUGGESTION
Files Reviewed (4 files)
Reviewed by free · Input: 0 · Output: 0 · Cached: 0 |
…air) Review Kilo #101. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Contenu
Nouveau canal d'alerte Nextcloud Talk pour le watchdog (
POST /ocs/v2.php/apps/spreed/api/v1/chat/<jeton>), en plus de ntfy et Telegram. Variables :NEXTCLOUD_URL,NEXTCLOUD_USER,NEXTCLOUD_PASSWORD(mot de passe d'application),NEXTCLOUD_TALK_TOKEN(jeton lu dans l'URL de la conversation). Gabarit dans.env.example, secrets jamais dans le code ni dans les logs (test dédié).Vérification
4 tests ajoutés (canal exigeant les 4 variables, endpoint et authentification, aucune fuite d'identifiants, erreur HTTP ≠ livraison).
ruffpropre.🤖 Generated with Claude Code