coolify

tiennm99/coolify

Fork 0

mirror of https://github.com/tiennm99/coolify.git synced 2026-08-20 16:23:30 +00:00

Commit Graph

Author	SHA1	Message	Date
Andras Bacsai	c97f916052	fix(api): hide application compose PR fields Add compose PR fields to the Application hidden attributes and allow database list queries to eager load nested server settings when sensitive access is permitted.	2026-05-11 11:46:05 +02:00
Andras Bacsai	8b7dbbafb2	fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens Models now declare $hidden for passwords, tokens, db URLs, and compose fields. API controllers flip from makeHidden-on-deny to makeVisible-on- allow (can_read_sensitive=true), fixing fields that were never hidden. Also adds missing fields (mysql/mariadb passwords, logdrain keys, etc.) to privileged disclosure lists. Tests added: Feature/Security/ApiSensitiveFieldsTest and Unit/Models/SensitiveFieldsHiddenTest cover all affected models and controllers.	2026-04-30 11:28:06 +02:00

Author

SHA1

Message

Date

Andras Bacsai

c97f916052

fix(api): hide application compose PR fields

Add compose PR fields to the Application hidden attributes and allow database list queries to eager load nested server settings when sensitive access is permitted.

2026-05-11 11:46:05 +02:00

Andras Bacsai

8b7dbbafb2

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

Models now declare $hidden for passwords, tokens, db URLs, and compose
fields. API controllers flip from makeHidden-on-deny to makeVisible-on-
allow (can_read_sensitive=true), fixing fields that were never hidden.
Also adds missing fields (mysql/mariadb passwords, logdrain keys, etc.)
to privileged disclosure lists.

Tests added: Feature/Security/ApiSensitiveFieldsTest and
Unit/Models/SensitiveFieldsHiddenTest cover all affected models and
controllers.

2026-04-30 11:28:06 +02:00