Webhook Authorization Header Returned in Plaintext via API

Affected: Go: code.gitea.io/gitea

## Summary

The `ToHook()` function in `services/webhook/general.go` decrypts the webhook's `HeaderAuthorizationEncrypted` field and returns the plaintext authorization header in the API response. Any repository admin can read the full plaintext value of webhook authorization headers (Bearer tokens, Basic auth credentials, API keys) set by other admins.

The authorization header is stored encrypted in the database using the server's `SecretKey`, but `ToHook()` decrypts it before serializing it into the API response — converting a write-only secret into a readable credential.

## Vulnerable Code

**File:** `services/webhook/general.go:407-420`

```go func ToHook(repoLink string, w *webhook_model.Webhook) (*api.Hook, error) { // ... authorizationHeader, err := w.HeaderAuthorization() // DECRYPTS from DB if err != nil { return nil, err } return &api.Hook{ // ... AuthorizationHeader: authorizationHeader, // PLAINTEXT in response // ... }, nil } ```

**Decryption function:** `models/webhook/webhook.go:209-216`

```go func (w Webhook) HeaderAuthorization() (string, error) { if w.HeaderAuthorizationEncrypted == "" { return "", nil } return secret.DecryptSecret(setting.SecretKey, w.HeaderAuthorizationEncrypted) } ```

## Affected Endpoints

All call `ToHook()`: - `GET /api/v1/repos/{owner}/{repo}/hooks` (requires repo admin) - `GET /api/v1/repos/{owner}/{repo}/hooks/{id}` (requires repo admin) - `GET /api/…

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.