No hook sender verification

[IgorDuino]

django-telegram-bot/dtb/views.py

Lines 25 to 39 in 6e3e617

	class TelegramBotWebhookView(View):
	# WARNING: if fail - Telegram webhook will be delivered again.
	# Can be fixed with async celery task execution
	def post(self, request, *args, **kwargs):
	if DEBUG:
	process_telegram_event(json.loads(request.body))
	else:
	# Process Telegram event in Celery worker (async)
	# Don't forget to run it and & Redis (message broker for Celery)!
	# Locally, You can run all of these services via docker-compose.yml
	process_telegram_event.delay(json.loads(request.body))
	# e.g. remove buttons, typing event
	return JsonResponse({"ok": "POST request processed"})

Anyone can send a request and imitate any actions of users who started the bot

According to the documentation, such a check is enough

• accept incoming POSTs only from subnets 149.154.160.0/20 and 91.108.4.0/22