tiennm99/coolify
1
0
Fork 0
mirror of https://github.com/tiennm99/coolify.git synced 2026-09-10 06:20:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): expose sensitive fields for privileged tokens

Browse Source 
Privileged API tokens can read hidden resource fields in environment and
resource responses, including instance-admin team tokens with team_id 0.

Configuration hashes now include hidden environment variable values so
secret edits trigger restart detection.
This commit is contained in:
Andras Bacsai
2026-07-07 12:53:34 +02:00
parent e9bef8443b
commit 9a2c432c79
16 changed files with 239 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Models/Service.php
+1 -1
View File
@@ -105,7 +105,7 @@ class Service extends BaseModel
$storages = $applicationStorages->merge($databaseStorages)->implode('updated_at');
$newConfigHash = $images.$domains.$images.$storages;
$newConfigHash .= json_encode($this->environment_variables()->get('value')->sort());
$newConfigHash .= json_encode($this->environment_variables()->get('value')->makeVisible('value')->sort());
$newConfigHash = md5($newConfigHash);
$oldConfigHash = data_get($this, 'config_hash');
if ($oldConfigHash === null) {