Umbraco's Blind SSRF Leads to Port Scan by using Webhooks

@@ -1015,6 +1015,8 @@
     <key alias="createHeader">Opret header</key>
     <key alias="deliveries">Leverancer</key>
     <key alias="noHeaders">Der er ikke tilføjet nogen webhook headers</key>
+    <key alias="toggleDebug">Skift til debug mode for mere information.</key>
+    <key alias="statusNotOk">Ikke OK status kode.</key>
   </area>
   <area alias="language">
     <key alias="cultureCode">Culture Code</key>

@@ -2032,6 +2032,8 @@ To manage your website, simply open the Umbraco backoffice and start adding cont
     <key alias="types">Types</key>
     <key alias="webhookKey">Webhook key</key>
     <key alias="retryCount">Retry count</key>
+    <key alias="toggleDebug">Toggle debug mode for more information.</key>
+    <key alias="statusNotOk">Not OK status code</key>
   </area>
   <area alias="languages">
     <key alias="addLanguage">Add language</key>

@@ -1,12 +1,23 @@
-using Umbraco.Cms.Core.Mapping;
+using Umbraco.Cms.Core.Hosting;
+using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Core.Webhooks;
 using Umbraco.Cms.Web.Common.Models;
 
 namespace Umbraco.Cms.Web.BackOffice.Mapping;
 
 public class WebhookMapDefinition : IMapDefinition
 {
+    private readonly IHostingEnvironment _hostingEnvironment;
+    private readonly ILocalizedTextService _localizedTextService;
+
+    public WebhookMapDefinition(IHostingEnvironment hostingEnvironment, ILocalizedTextService localizedTextService)
+    {
+        _hostingEnvironment = hostingEnvironment;
+        _localizedTextService = localizedTextService;
+    }
+
     public void DefineMaps(IUmbracoMapper mapper)
     {
         mapper.Define<WebhookViewModel, IWebhook>((_, _) => new Webhook(string.Empty), Map);
@@ -40,13 +51,22 @@ private void Map(WebhookLog source, WebhookLogViewModel target, MapperContext co
         target.EventAlias = source.EventAlias;
         target.Key = source.Key;
         target.RequestBody = source.RequestBody ?? string.Empty;
-        target.ResponseBody = source.ResponseBody;
         target.RetryCount = source.RetryCount;
-        target.StatusCode = source.StatusCode;
         target.Url = source.Url;
         target.RequestHeaders = source.RequestHeaders;
-        target.ResponseHeaders = source.ResponseHeaders;
         target.WebhookKey = source.WebhookKey;
-        target.ExceptionOccured = source.ExceptionOccured;
+
+        if (_hostingEnvironment.IsDebugMode)
+        {
+            target.ExceptionOccured = source.ExceptionOccured;
+            target.ResponseBody = source.ResponseBody;
+            target.ResponseHeaders = source.ResponseHeaders;
+            target.StatusCode = source.StatusCode;
+        }
+        else
+        {
+            target.ResponseBody = _localizedTextService.Localize("webhooks", "toggleDebug", Thread.CurrentThread.CurrentUICulture);
+            target.StatusCode = source.StatusCode is "OK (200)" ? source.StatusCode : _localizedTextService.Localize("webhooks", "statusNotOk", Thread.CurrentThread.CurrentUICulture);
+        }
     }
 }