tiennm99/coolify
1
0 Fork 0
mirror of https://github.com/tiennm99/coolify.git synced 2026-10-03 07:12:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): hide notification secrets from non-admins

Browse Source 
Prevent users without update permission from reading notification credentials and manual webhook secrets in Livewire state or rendered forms.
This commit is contained in:
Andras Bacsai committed 2026-06-04 11:24:19 +02:00
1 parent 062ad57740
commit 5973bb4d4f
14 files changed
+219 -45
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

app/Livewire/Notifications/Pushover.php
+7 -2
View File
@@ -113,8 +113,13 @@ class Pushover extends Component
refreshSession();
} else {
$this->pushoverEnabled = $this->settings->pushover_enabled;
$this->pushoverUserKey = $this->settings->pushover_user_key;
$this->pushoverApiToken = $this->settings->pushover_api_token;
if (auth()->user()->can('update', $this->settings)) {
$this->pushoverUserKey = $this->settings->pushover_user_key;
$this->pushoverApiToken = $this->settings->pushover_api_token;
} else {
$this->pushoverUserKey = null;
$this->pushoverApiToken = null;
}
$this->deploymentSuccessPushoverNotifications = $this->settings->deployment_success_pushover_notifications;
$this->deploymentFailurePushoverNotifications = $this->settings->deployment_failure_pushover_notifications;