Merge pull request #684 from hackmdio/fixDropboxAppKey

SISheogorath · web-flow · commit feb89f02e294 · 2018-01-19T14:31:04.000+01:00
Fix not passing app key correctly in dropbox config ⚠️ Dropbox ClientSecret was leaked ⚠️ Fixes #683
diff --git a/app.js b/app.js
@@ -34,7 +34,7 @@ var data = {
   version: config.version,
   GOOGLE_API_KEY: config.google.clientSecret,
   GOOGLE_CLIENT_ID: config.google.clientID,
-  DROPBOX_APP_KEY: config.dropbox.clientSecret
+  DROPBOX_APP_KEY: config.dropbox.appKey
 }
 
 ejs.renderFile(constpath, data, {}, function (err, str) {
diff --git a/lib/config/default.js b/lib/config/default.js
@@ -81,7 +81,8 @@ module.exports = {
   },
   dropbox: {
     clientID: undefined,
-    clientSecret: undefined
+    clientSecret: undefined,
+    appKey: undefined
   },
   google: {
     clientID: undefined,
diff --git a/lib/config/dockerSecret.js b/lib/config/dockerSecret.js
@@ -44,7 +44,8 @@ if (fs.existsSync(basePath)) {
     },
     dropbox: {
       clientID: getSecret('dropbox_clientID'),
-      clientSecret: getSecret('dropbox_clientSecret')
+      clientSecret: getSecret('dropbox_clientSecret'),
+      appKey: getSecret('dropbox_appKey')
     },
     google: {
       clientID: getSecret('google_clientID'),
diff --git a/lib/config/environment.js b/lib/config/environment.js
@@ -56,7 +56,8 @@ module.exports = {
   },
   dropbox: {
     clientID: process.env.HMD_DROPBOX_CLIENTID,
-    clientSecret: process.env.HMD_DROPBOX_CLIENTSECRET
+    clientSecret: process.env.HMD_DROPBOX_CLIENTSECRET,
+    appKey: process.env.HMD_DROPBOX_APPKEY
   },
   google: {
     clientID: process.env.HMD_GOOGLE_CLIENTID,

Original file line number	Diff line number	Diff line change
`@@ -34,7 +34,7 @@ var data = {`
`34`	`34`	`version: config.version,`
`35`	`35`	`GOOGLE_API_KEY: config.google.clientSecret,`
`36`	`36`	`GOOGLE_CLIENT_ID: config.google.clientID,`
`37`		`- DROPBOX_APP_KEY: config.dropbox.clientSecret`
	`37`	`+ DROPBOX_APP_KEY: config.dropbox.appKey`
`38`	`38`	`}`
`39`	`39`
`40`	`40`	`ejs.renderFile(constpath, data, {}, function (err, str) {`