tiennm99/coolify
1
0
Fork 0
mirror of https://github.com/tiennm99/coolify.git synced 2026-09-05 22:16:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(backup): validate MongoDB collection names in backup input

Browse Source 
Add validateDatabasesBackupInput() helper that properly parses all
database backup formats including MongoDB's "db:col1,col2|db2:col3"
and validates each component individually.

- Validate and escape collection names in DatabaseBackupJob
- Replace comma-only split in BackupEdit with format-aware validation
- Add input validation in API create_backup and update_backup endpoints
- Add unit tests for collection name and multi-format validation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Andras Bacsai
2026-03-25 16:52:06 +01:00
co-authored by Claude Opus 4.6
parent 1bd957073b
commit 99043600ee
5 changed files with 150 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Controllers/Api/DatabasesController.php
+24
View File
@@ -792,6 +792,18 @@ class DatabasesController extends Controller
}
}
// Validate databases_to_backup input
if (! empty($backupData['databases_to_backup'])) {
try {
validateDatabasesBackupInput($backupData['databases_to_backup']);
} catch (\Exception $e) {
return response()->json([
'message' => 'Validation failed.',
'errors' => ['databases_to_backup' => [$e->getMessage()]],
], 422);
}
}
// Add required fields
$backupData['database_id'] = $database->id;
$backupData['database_type'] = $database->getMorphClass();
@@ -997,6 +1009,18 @@ class DatabasesController extends Controller
unset($backupData['s3_storage_uuid']);
}
// Validate databases_to_backup input
if (! empty($backupData['databases_to_backup'])) {
try {
validateDatabasesBackupInput($backupData['databases_to_backup']);
} catch (\Exception $e) {
return response()->json([
'message' => 'Validation failed.',
'errors' => ['databases_to_backup' => [$e->getMessage()]],
], 422);
}
}
$backupConfig->update($backupData);
if ($request->backup_now) {