Check the X-Telegram-Bot-Api-Secret-Token header on update request to…

… the webhook
antimech · Oct 20, 2023 · ebe25ee · ebe25ee
1 parent 729ccdf
commit ebe25ee
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/src/TelegramDriver.php b/src/TelegramDriver.php
@@ -61,6 +61,12 @@ public function buildPayload(Request $request)
         $this->event = Collection::make($message);
         $this->config = Collection::make($this->config->get('telegram'));
         $this->queryParameters = Collection::make($request->query);
+
+        $token = $request->headers->get('X-Telegram-Bot-Api-Secret-Token');
+
+        if ($token !== str_replace(':', '_', $this->config->get('token'))) {
+            throw new \Exception('Token mismatch!');
+        }
     }
 
     /**