Andras Bacsai 8b7dbbafb2 fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens ...

Models now declare $hidden for passwords, tokens, db URLs, and compose
fields. API controllers flip from makeHidden-on-deny to makeVisible-on-
allow (can_read_sensitive=true), fixing fields that were never hidden.
Also adds missing fields (mysql/mariadb passwords, logdrain keys, etc.)
to privileged disclosure lists.

Tests added: Feature/Security/ApiSensitiveFieldsTest and
Unit/Models/SensitiveFieldsHiddenTest cover all affected models and
controllers.

2026-04-30 11:28:06 +02:00

..

Application.php

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

2026-04-30 11:28:06 +02:00

ApplicationDeploymentQueue.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

ApplicationPreview.php

refactor(volumes): validate input and escape shell args

2026-04-20 11:27:10 +02:00

ApplicationSetting.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

BaseModel.php

…

CloudInitScript.php

refactor: improve cloud-init script UX and remove description field

2025-10-11 11:16:28 +02:00

CloudProviderToken.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

DiscordNotificationSettings.php

refactor: define explicit fillable attributes on all Eloquent models

2026-03-29 21:25:41 +02:00

DockerCleanupExecution.php

feat(deployments): support Docker image tags for preview deployments

2026-03-30 13:35:35 +02:00

EmailNotificationSettings.php

refactor: define explicit fillable attributes on all Eloquent models

2026-03-29 21:25:41 +02:00

Environment.php

Merge remote-tracking branch 'origin/next' into pr-7764-shadow/add-shared-server-env

2026-03-31 13:51:06 +02:00

EnvironmentVariable.php

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

2026-04-30 11:28:06 +02:00

GithubApp.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

GitlabApp.php

refactor: define explicit fillable attributes on all Eloquent models

2026-03-29 21:25:41 +02:00

InstanceSettings.php

feat(mcp): add MCP server with read-only tools for Coolify resources

2026-04-29 10:30:43 +02:00

LocalFileVolume.php

fix(service): block UI editing of file volumes exceeding 5 MiB

2026-04-28 22:36:56 +02:00

LocalPersistentVolume.php

refactor: define explicit fillable attributes on all Eloquent models

2026-03-29 21:25:41 +02:00

OauthSetting.php

feat(auth): Add Clerk OAuth Provider (#5553)

2025-06-18 14:29:46 +02:00

PersonalAccessToken.php

…

PrivateKey.php

fix(ssh): handle chmod failures gracefully and simplify key management

2026-03-16 21:27:10 +01:00

Project.php

Merge remote-tracking branch 'origin/next' into pr-7764-shadow/add-shared-server-env

2026-03-31 13:51:06 +02:00

ProjectSetting.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

PushoverNotificationSettings.php

refactor: define explicit fillable attributes on all Eloquent models

2026-03-29 21:25:41 +02:00

S3Storage.php

refactor(storage): tighten S3 endpoint URL validation (#9668)

2026-04-20 11:51:51 +02:00

ScheduledDatabaseBackup.php

fix(backups): enforce retention and clean up stale executions

2026-04-03 11:33:21 +02:00

ScheduledDatabaseBackupExecution.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

ScheduledTask.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

ScheduledTaskExecution.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

Server.php

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

2026-04-30 11:28:06 +02:00

ServerSetting.php

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

2026-04-30 11:28:06 +02:00

Service.php

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

2026-04-30 11:28:06 +02:00

ServiceApplication.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

ServiceDatabase.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

SharedEnvironmentVariable.php

fix(deployment): resolve shared env vars using main server

2026-03-31 11:07:52 +02:00

SlackNotificationSettings.php

refactor: define explicit fillable attributes on all Eloquent models

2026-03-29 21:25:41 +02:00

SslCertificate.php

fix(ssl): when regenerating SSL certs the cert is not singed with the new CN

2025-02-07 19:36:52 +01:00

StandaloneClickhouse.php

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

2026-04-30 11:28:06 +02:00

StandaloneDocker.php

refactor: scope destination and resource lookups by current team

2026-04-19 11:55:12 +02:00

StandaloneDragonfly.php

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

2026-04-30 11:28:06 +02:00

StandaloneKeydb.php

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

2026-04-30 11:28:06 +02:00

StandaloneMariadb.php

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

2026-04-30 11:28:06 +02:00

StandaloneMongodb.php

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

2026-04-30 11:28:06 +02:00

StandaloneMysql.php

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

2026-04-30 11:28:06 +02:00

StandalonePostgresql.php

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

2026-04-30 11:28:06 +02:00

StandaloneRedis.php

fix(api): hide sensitive fields by default, expose via makeVisible for privileged tokens

2026-04-30 11:28:06 +02:00

Subscription.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

SwarmDocker.php

refactor: scope destination and resource lookups by current team

2026-04-19 11:55:12 +02:00

Tag.php

fix(models): replace forceFill/forceCreate with fill/create and add fillable guards

2026-03-31 13:45:31 +02:00

Team.php

fix(team): mark servers unreachable when subscription ends

2026-04-15 15:12:29 +02:00

TeamInvitation.php

Update app/Models/TeamInvitation.php

2025-09-25 11:33:32 +02:00

TelegramNotificationSettings.php

refactor: define explicit fillable attributes on all Eloquent models

2026-03-29 21:25:41 +02:00

User.php

refactor(auth): upgrade email verification hash to sha256

2026-04-20 12:09:48 +02:00

UserChangelogRead.php

feat(changelog): implement automated changelog fetching from GitHub and enhance changelog read tracking

2025-08-12 10:07:11 +02:00

WebhookNotificationSettings.php

fix: update webhook notification settings migration to use updateOrInsert and add logging

2025-11-25 15:35:01 +01:00