tiennm99/coolify
1
0
Fork 0
mirror of https://github.com/tiennm99/coolify.git synced 2026-07-12 03:05:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): enforce team-scoped project/env lookups in onboarding

Browse Source 
Use firstOrFail() for team-scoped project and environment lookups across
new-project Livewire flows so missing or cross-team UUIDs fail closed.
Also dispatch an error when boarding selects a non-owned project, and
update IDOR feature tests for the new error/exception behavior.
This commit is contained in:
Andras Bacsai
2026-03-29 15:55:03 +02:00
parent e36622fdfb
commit 3ba4553df5
8 changed files with 17 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php
+2 -2
View File
@@ -144,8 +144,8 @@ class GithubPrivateRepositoryDeployKey extends Component
// Note: git_repository has already been validated and transformed in get_git_source()
// It may now be in SSH format (git@host:repo.git) which is valid for deploy keys
$project = Project::ownedByCurrentTeam()->where('uuid', $this->parameters['project_uuid'])->first();
$environment = $project->load(['environments'])->environments->where('uuid', $this->parameters['environment_uuid'])->first();
$project = Project::ownedByCurrentTeam()->where('uuid', $this->parameters['project_uuid'])->firstOrFail();
$environment = $project->environments()->where('uuid', $this->parameters['environment_uuid'])->firstOrFail();
if ($this->git_source === 'other') {
$application_init = [
'name' => generate_random_name(),