Merge pull request #4194 from quarkcore/fix/gitlab-empty-webhook-secret

Fix: Gitlab webhooks can be triggered without secret

app/Http/Controllers/Webhook/Gitlab.php

@@ -33,6 +33,7 @@ class Gitlab extends Controller
 
                 return;
             }
+
             $return_payloads = collect([]);
             $payload = $request->collect();
             $headers = $request->headers->all();
@@ -48,6 +49,16 @@ class Gitlab extends Controller
                 return response($return_payloads);
             }
 
+            if (empty($x_gitlab_token)) {
+                $return_payloads->push([
+                    'status' => 'failed',
+                    'message' => 'Invalid signature.',
+                ]);
+                ray('Invalid signature');
+
+                return response($return_payloads);
+            }
+
             if ($x_gitlab_event === 'push') {
                 $branch = data_get($payload, 'ref');
                 $full_name = data_get($payload, 'project.path_with_namespace');