tiennm99/coolify
1
0
Fork 0
mirror of https://github.com/tiennm99/coolify.git synced 2026-08-22 08:23:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): expose sensitive fields for privileged tokens

Browse Source 
Privileged API tokens can read hidden resource fields in environment and
resource responses, including instance-admin team tokens with team_id 0.

Configuration hashes now include hidden environment variable values so
secret edits trigger restart detection.
This commit is contained in:
Andras Bacsai
2026-07-07 12:53:34 +02:00
parent e9bef8443b
commit 9a2c432c79
16 changed files with 239 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Middleware/ApiSensitiveData.php
+3 -2
View File
@@ -11,8 +11,9 @@ class ApiSensitiveData
{
$token = $request->user()->currentAccessToken();
$hasTokenPermission = $token->can('root') || $token->can('read:sensitive');
$teamId = (int) data_get($token, 'team_id');
$isAdmin = $teamId ? $request->user()->isAdminOfTeam($teamId) : false;
$teamId = data_get($token, 'team_id');
// team_id 0 is the instance-admin team, so a falsy check must not exclude it
$isAdmin = ! is_null($teamId) ? $request->user()->isAdminOfTeam((int) $teamId) : false;
// Allow access to sensitive data only if token has permission AND user is admin/owner
$request->attributes->add([