mirror/coolify
1
0
Fork 1
mirror of https://github.com/coollabsio/coolify.git synced 2026-06-19 07:35:25 +00:00
Code Issues Packages Projects Releases Wiki Activity
15,887 Commits 80 Branches 680 Tags
e7dff30b7c998c301fd91bd169727b90c59ec291
Commit Graph

16 Commits

Author SHA1 Message Date
Andras Bacsai 2bb07bbe9e fix: validate application branch updates 2026-06-01 15:13:04 +02:00
Andras Bacsai 5dda39e588 fix(source): scope private key and source selection to current team 
The Source component now resolves the supplied private key and Git
source IDs through team-scoped queries before persisting them, so a
selection can only ever reference a resource owned by the current
team. The source type is additionally restricted to the supported
GitHub/GitLab app classes.

The privateKeyId property is marked #[Locked] so it can only change
through the dedicated handler rather than a direct property update.

Adds feature tests covering team-scoped selection of private keys and
Git sources.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-22 12:30:00 +02:00
Andras Bacsai 0ecd488d6a fix(applications): refresh pending configuration changes 
Dispatch configuration change events after saving application source and advanced settings, and refresh the configuration checker before showing redeploy diffs.
 2026-05-13 10:04:17 +02:00
Andras Bacsai a1c30cb0e7 fix(git-ref-validation): prevent command injection via git references 
Add validateGitRef() helper function that uses an allowlist approach to prevent
OS command injection through git commit SHAs, branch names, and tags. Only allows
alphanumeric characters, dots, hyphens, underscores, and slashes.

Changes include:
- Add validateGitRef() helper in bootstrap/helpers/shared.php
- Apply validation in Rollback component when accepting rollback commit
- Add regex validation to git commit SHA fields in Livewire components
- Apply regex validation to API rules for git_commit_sha
- Use escapeshellarg() in git log and git checkout commands
- Add comprehensive unit tests covering injection payloads

Addresses GHSA-mw5w-2vvh-mgf4
 2026-03-10 22:22:48 +01:00
Andras Bacsai 1fe7df7e38 fix(git): trim whitespace from repository, branch, and commit SHA fields 
- Add automatic trimming in Application model's boot method for git_repository, git_branch, and git_commit_sha fields
- Add real-time trimming in Source Livewire component via updated{Property} methods
- Refresh component state after save to ensure UI displays trimmed values
- Prevents deployment issues caused by accidental whitespace in git configuration
 2025-09-30 12:33:40 +02:00
Andras Bacsai 40f108d6e1 feat(auth): implement authorization checks for application management 2025-08-22 16:47:59 +02:00
Andras Bacsai 3643a388bf fix(github): changing github app breaks the webhook. it does not anymore 2025-06-21 19:28:38 +02:00
Andras Bacsai cd2f71b463 feat(deployment): add repository_project_id handling for private GitHub apps and clean up unused Caddy label logic 2025-04-22 10:20:57 +02:00
Andras Bacsai 4c95dccfb3 refactor(SourceManagement): sort sources by name and improve UI for changing Git source with better error handling 2025-04-11 20:25:25 +02:00
Andras Bacsai ec36825545 feat(SourceManagement): add functionality to change Git source and display current source in the application settings 2025-04-11 18:22:42 +02:00
Andras Bacsai 1fe4dd722b Revert "rector: arrrrr" 
This reverts commit 16c0cd10d8.
 2025-01-07 15:31:43 +01:00
Andras Bacsai 16c0cd10d8 rector: arrrrr 2025-01-07 14:52:08 +01:00
Andras Bacsai 9b578b2003 do not use Rule (deprecated), changed to Validate 2024-11-05 09:36:40 +01:00
Andras Bacsai 83b3f6fe49 refactor application source view 2024-11-04 00:14:44 +01:00
Thijmen d86274cc37 Fix styling 2024-06-10 20:43:34 +00:00
Andras Bacsai 718603e37e wip: migrate to livewire 3 2023-12-07 19:06:32 +01:00