Andras BacsaiandClaude Opus 4.6 952f324797 fix(backup): use escapeshellarg for credentials in database backup commands ...

Apply proper shell escaping to all user-controlled values interpolated into
backup shell commands (PostgreSQL username/password, MySQL/MariaDB root
password, MongoDB URI). Also URL-encode MongoDB credentials before embedding
in connection URI. Adds unit tests for escaping behavior.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-25 23:43:57 +01:00

..

Actions

chore: prepare for PR

2026-03-10 18:32:19 +01:00

Api

Add autogenerate_domain API parameter for applications

2025-12-05 21:16:04 +01:00

Jobs

Combine stop+start into single activity for real-time logs

2025-12-03 16:21:26 +01:00

Livewire

feat: enhance environment variable handling to support mixed formats and add comprehensive tests

2025-12-27 15:24:09 +01:00

Notifications/Channels

feat(EmailChannel): enhance error handling with user-friendly messages for Resend API errors

2025-11-11 13:23:45 +01:00

Parsers

Inject commit-based image tags for Docker Compose build services

2025-12-05 11:41:47 +01:00

Policies

feat(healthchecks): add command health checks with input validation

2026-02-25 11:38:09 +01:00

Project/Database

feat: add validation methods for S3 bucket names, paths, and server paths; update import logic to prevent command injection

2025-11-25 16:40:35 +01:00

Rules

feat: add YAML validation for cloud-init scripts

2025-10-11 13:56:55 +02:00

AllExcludedContainersConsistencyTest.php

fix: don't show health status for exited containers

2025-11-24 09:09:37 +01:00

ApplicationComposeEditorLoadTest.php

test(factories): add missing model factories for app test suite

2026-03-03 09:50:05 +01:00

ApplicationConfigurationChangeTest.php

fix: trigger configuration changed detection for build settings

2025-11-27 12:22:54 +01:00

ApplicationDeploymentCustomBuildCommandTest.php

Fix: Docker build args injection regex to support service names

2025-12-01 13:16:05 +01:00

ApplicationDeploymentEmptyEnvTest.php

Changes auto-committed by Conductor

2025-10-21 20:39:39 +02:00

ApplicationDeploymentErrorLoggingTest.php

fix(deployment): improve error logging with exception types and hidden technical details

2025-11-17 14:44:39 +01:00

ApplicationDeploymentNixpacksNullEnvTest.php

fix(deployment): properly escape shell arguments in nixpacks commands

2026-03-23 21:55:46 +01:00

ApplicationDeploymentTypeTest.php

fix(application): clarify deployment type precedence logic

2026-03-12 13:48:30 +01:00

ApplicationGitSecurityTest.php

fix: prevent command injection in git ls-remote operations

2025-10-15 14:53:50 +02:00

ApplicationHealthcheckRemovalTest.php

Changes auto-committed by Conductor

2025-10-22 12:41:17 +02:00

ApplicationNetworkAliasesSyncTest.php

refactor: Improve handling of custom network aliases

2025-11-01 13:13:14 +01:00

ApplicationParserStringableTest.php

fix: convert Stringable to plain strings in applicationParser for strict comparisons and collection lookups

2025-11-24 09:22:27 +01:00

ApplicationPortDetectionTest.php

test(factories): add missing model factories for app test suite

2026-03-03 09:50:05 +01:00

ApplicationServiceEnvironmentVariablesTest.php

fix: properly handle SERVICE_URL and SERVICE_FQDN for abbreviated service names (#7243)

2025-11-21 11:21:49 +01:00

ApplicationSettingStaticCastTest.php

feat: Update ApplicationSetting model to include additional boolean casts

2025-11-04 08:43:33 +01:00

ApplicationWatchPathsTest.php

refactor(tests): simplify matchWatchPaths tests and update implementation for better clarity

2025-09-26 14:33:18 +02:00

BashEnvEscapingTest.php

fix: handle null environment variable values in bash escaping

2025-10-15 13:35:58 +02:00

CheckForUpdatesJobTest.php

Fix: Fragile service name parsing in applyServiceApplicationPrerequisites

2025-11-28 17:42:04 +01:00

CheckTraefikVersionForServerJobTest.php

feat(proxy): enhance Traefik version notifications to show patch and minor upgrades

2025-11-18 14:53:49 +01:00

CheckTraefikVersionJobTest.php

refactor: send immediate Traefik version notifications instead of delayed aggregation

2025-11-18 14:54:21 +01:00

ClickhouseOfficialImageMigrationTest.php

fix: prevent metric charts from freezing when navigating with wire:navigate

2026-01-02 12:36:17 +01:00

CloudInitScriptValidationTest.php

feat: add cloud-init script support for Hetzner server creation

2025-10-10 19:37:16 +02:00

ComposerAuthEnvEscapingTest.php

fix(env): skip escaping for valid JSON in environment variables (#6160)

2026-01-28 10:59:00 +01:00

ContainerHealthStatusTest.php

test(factories): add missing model factories for app test suite

2026-03-03 09:50:05 +01:00

ContainerStatusAggregatorTest.php

Fix complex status logic: handle degraded sub-resources and mixed running+starting states

2025-12-02 21:47:15 +01:00

CoolifyTaskCleanupTest.php

feat: streamline S3 restore with single-step flow and improved UI consistency

2025-11-17 10:05:18 +01:00

DatabaseBackupSecurityTest.php

fix(backup): use escapeshellarg for credentials in database backup commands

2026-03-25 23:43:57 +01:00

DatalistComponentTest.php

feat: add support for selecting additional SSH keys from Hetzner in server creation form

2025-10-10 12:17:05 +02:00

DeploymentCommandNewlineInjectionTest.php

fix(deployment): normalize whitespace in pre/post deployment commands

2026-03-25 20:57:17 +01:00

DeploymentExceptionTest.php

feat(DeploymentException): add custom exception for deployment errors and update handler to exclude from reporting

2025-11-11 15:08:26 +01:00

DockerComposeEmptyStringPreservationTest.php

feat: Implement required port validation for service applications

2025-11-06 14:32:36 +01:00

DockerComposeEmptyTopLevelSectionsTest.php

fix: preserve empty strings and remove empty sections in docker-compose

2025-11-06 12:30:03 +01:00

DockerComposeLabelParsingTest.php

Changes auto-committed by Conductor

2025-10-16 08:51:15 +02:00

DockerComposePreserveRepositoryStartCommandTest.php

fix(docker-compose): respect preserveRepository when injecting --project-directory

2026-03-13 13:53:03 +01:00

DockerComposeRawContentRemovalTest.php

Fix: Preserve clean docker_compose_raw without Coolify additions

2025-10-23 19:07:12 +02:00

DockerComposeRawSeparationTest.php

Fix: Preserve clean docker_compose_raw without Coolify additions

2025-10-23 19:07:12 +02:00

DockerfileArgInsertionTest.php

test: add unit tests for Dockerfile ARG insertion logic

2025-11-06 08:54:40 +01:00

DockerImageAutoParseTest.php

fix: improve Docker image digest handling and add auto-parse feature

2025-10-15 10:19:01 +02:00

DockerImageParserTest.php

fix: improve Docker image digest handling and add auto-parse feature

2025-10-15 10:19:01 +02:00

EnvironmentVariableFillableTest.php

feat(models): add is_required to EnvironmentVariable fillable array

2026-03-02 12:34:30 +01:00

EnvironmentVariableMagicVariableTest.php

feat: add magic variable detection and update UI behavior accordingly

2025-12-27 15:24:09 +01:00

EnvironmentVariableParsingEdgeCasesTest.php

fix(bootstrap): add bounds check to extractBalancedBraceContent

2026-03-02 12:24:40 +01:00

EnvVarInputComponentTest.php

feat: add environment variable autocomplete component

2025-11-19 10:54:19 +01:00

EscapeShellValueTest.php

fix(deployment): properly escape shell arguments in nixpacks commands

2026-03-23 21:55:46 +01:00

ExcludeFromHealthCheckTest.php

fix: don't show health status for exited containers

2025-11-24 09:09:37 +01:00

ExecuteInDockerEscapingTest.php

chore: prepare for PR

2026-02-25 11:50:57 +01:00

ExtractHardcodedEnvironmentVariablesTest.php

feat: add comprehensive environment variable parsing with nested resolution and hardcoded variable detection

2025-12-27 15:24:53 +01:00

ExtractYamlEnvironmentCommentsTest.php

feat: add function to extract inline comments from docker-compose YAML environment variables

2025-12-27 15:24:09 +01:00

FileStorageSecurityTest.php

fix: enhance security by validating and escaping database names, file paths, and proxy configuration filenames to prevent command injection

2025-11-27 14:36:31 +01:00

FormatBytesTest.php

feat: streamline S3 restore with single-step flow and improved UI consistency

2025-11-17 10:05:18 +01:00

FormatContainerStatusTest.php

feat: implement formatContainerStatus helper for human-readable status formatting and add unit tests

2025-11-21 09:12:56 +01:00

GetContainersStatusEmptyContainerSafeguardTest.php

chore: prepare for PR

2026-03-10 18:34:37 +01:00

GetContainersStatusServiceAggregationTest.php

fix: correct Sentinel default health status and remove debug logging

2025-11-20 11:10:34 +01:00

GitlabSourceCommandsTest.php

feat(gitlab): add GitLab source integration with SSH and HTTP basic auth

2026-03-11 15:30:46 +01:00

GitLsRemoteParsingTest.php

test: improve Git ls-remote parsing tests with uppercase SHA and negative cases

2025-10-14 17:34:26 +02:00

GitRefValidationTest.php

fix(git-ref-validation): prevent command injection via git references

2026-03-10 22:22:48 +01:00

GlobalSearchNewImageQuickActionTest.php

fix: 'new image' quick action not progressing to resource selection

2025-10-15 10:49:07 +02:00

HealthCheckCommandInjectionTest.php

Squashed commit from '4fhp-investigate-os-command-injection'

2026-03-16 16:40:16 +01:00

HetznerDeletionFailedNotificationTest.php

test(factories): add missing model factories for app test suite

2026-03-03 09:50:05 +01:00

HetznerServiceTest.php

feat: add Hetzner Cloud server linking for manually-added servers

2025-12-11 22:14:41 +01:00

HetznerSshKeysTest.php

feat: add support for selecting additional SSH keys from Hetzner in server creation form

2025-10-10 12:17:05 +02:00

LocalFileVolumeReadOnlyTest.php

fix: Detect read-only Docker volumes with long-form syntax and enable refresh

2025-12-11 14:18:58 +01:00

LogDrainCommandInjectionTest.php

fix(log-drain): prevent command injection by base64-encoding environment variables

2026-03-10 22:22:51 +01:00

LogViewerXssSecurityTest.php

Move inline styles to global CSS file

2025-12-04 13:15:01 +01:00

MetricsDownsamplingTest.php

fix: prevent metric charts from freezing when navigating with wire:navigate

2026-01-02 12:36:17 +01:00

NestedEnvironmentVariableParsingTest.php

chore: prepare for PR

2026-03-10 17:37:13 +01:00

NestedEnvironmentVariableTest.php

feat: add comprehensive environment variable parsing with nested resolution and hardcoded variable detection

2025-12-27 15:24:53 +01:00

NotifyOutdatedTraefikServersJobTest.php

feat(proxy): enhance Traefik version notifications to show patch and minor upgrades

2025-11-18 14:53:49 +01:00

ParseCommandsByLineForSudoTest.php

fix: resolve Docker validation race conditions and sudo prefix bug

2025-11-27 09:04:42 +01:00

ParseDockerVolumeStringTest.php

fix(parsers): enhance volume string handling by preserving mode in application and service parsers. Update related unit tests for validation.

2025-08-27 16:54:49 +02:00

ParseEnvFormatToArrayTest.php

feat: add comment field to environment variables

2025-12-27 15:24:09 +01:00

PathTraversalSecurityTest.php

feat: streamline S3 restore with single-step flow and improved UI consistency

2025-11-17 10:05:18 +01:00

PostgresqlInitScriptSecurityTest.php

fix: enhance security by validating and escaping database names, file paths, and proxy configuration filenames to prevent command injection

2025-11-27 14:36:31 +01:00

PostgRESTDetectionTest.php

Fix PostgREST misclassification and empty Domains section

2025-12-01 16:52:09 +01:00

PreSaveValidationTest.php

fix: prevent command injection in Docker Compose parsing - add pre-save validation

2025-10-16 09:51:37 +02:00

PreviewDeploymentBindMountTest.php

fix(storages): hide PR suffix for services and fix instantSave logic

2026-03-16 21:10:00 +01:00

PreviewDeploymentPortTest.php

test: Add comprehensive preview deployment port and path tests

2025-12-17 21:35:54 +01:00

PrivateKeyStorageTest.php

chore: prepare for PR

2026-02-26 16:27:02 +01:00

ProxyConfigRecoveryTest.php

feat(proxy): validate stored config matches current proxy type

2026-03-24 21:32:34 +01:00

ProxyConfigurationSecurityTest.php

fix: enhance security by validating and escaping database names, file paths, and proxy configuration filenames to prevent command injection

2025-11-27 14:36:31 +01:00

ProxyCustomCommandsTest.php

feat(proxy): enhance proxy configuration regeneration by extracting custom commands

2025-10-07 11:11:13 +02:00

ProxyHelperTest.php

Fix: Traefik proxy startup issues - handle null versions and filter predefined networks

2025-11-28 17:53:26 +01:00

RestartCountTrackingTest.php

feat: add container restart tracking and crash loop detection

2025-11-10 13:04:31 +01:00

RestoreJobFinishedNullServerTest.php

fix: improve robustness and security in database restore flows

2025-11-17 14:13:10 +01:00

RestoreJobFinishedSecurityTest.php

feat: streamline S3 restore with single-step flow and improved UI consistency

2025-11-17 10:05:18 +01:00

RestoreJobFinishedShellEscapingTest.php

feat: improve S3 restore path handling and validation state

2025-11-25 10:18:30 +01:00

S3RestoreSecurityTest.php

feat: streamline S3 restore with single-step flow and improved UI consistency

2025-11-17 10:05:18 +01:00

S3RestoreTest.php

feat: add S3 storage integration for file import

2025-11-14 10:43:19 +01:00

S3StorageTest.php

feat: streamline S3 restore with single-step flow and improved UI consistency

2025-11-17 10:05:18 +01:00

SanitizeLogsForExportTest.php

feat(gitlab): add GitLab source integration with SSH and HTTP basic auth

2026-03-11 15:30:46 +01:00

ScheduledJobManagerLockTest.php

chore: prepare for PR

2026-02-25 12:07:29 +01:00

ScheduledJobsRetryConfigTest.php

feat(DatabaseBackupJob, ScheduledTaskJob): enforce minimum timeout and add execution ID for timeout handling

2025-11-11 12:07:39 +01:00

ScheduledTaskJobTimeoutTest.php

feat(DatabaseBackupJob, ScheduledTaskJob): enforce minimum timeout and add execution ID for timeout handling

2025-11-11 12:07:39 +01:00

ServerManagerJobExecutionTimeTest.php

Fix: Pass $serverTimezone to shouldRunNow() in ServerCheckJob dispatch

2025-12-02 16:58:43 +01:00

ServerManagerJobSentinelCheckTest.php

test(factories): add missing model factories for app test suite

2026-03-03 09:50:05 +01:00

ServerQueryScopeTest.php

test(factories): add missing model factories for app test suite

2026-03-03 09:50:05 +01:00

ServerStatusAccessorTest.php

feat(tests): add comprehensive tests for ContainerStatusAggregator and serverStatus accessor

2025-11-20 17:31:07 +01:00

ServiceApplicationPrerequisitesTest.php

Fix: Fragile service name parsing in applyServiceApplicationPrerequisites

2025-11-28 17:42:04 +01:00

ServiceConfigurationRefreshTest.php

fix: prevent duplicate services on image change and enable real-time UI refresh

2025-10-14 10:12:36 +02:00

ServiceExcludedStatusTest.php

fix: don't show health status for exited containers

2025-11-24 09:09:37 +01:00

ServiceIndexValidationTest.php

fix(proxy): add validation and normalization for database proxy timeout

2026-03-10 09:59:19 +01:00

ServiceNameSecurityTest.php

fix: prevent command injection in Docker Compose parsing - add pre-save validation

2025-10-16 09:51:37 +02:00

ServiceParserEnvVarPreservationTest.php

fix(parsers): preserve ${VAR} references in compose instead of resolving to DB values

2026-03-24 21:52:36 +01:00

ServiceParserImageUpdateTest.php

fix: prevent duplicate services on image change and enable real-time UI refresh

2025-10-14 10:12:36 +02:00

ServiceParserPathDuplicationTest.php

fix: prevent SERVICE_FQDN/SERVICE_URL path duplication on FQDN updates

2025-11-27 10:57:24 +01:00

ServiceParserPortDetectionLogicTest.php

feat: implement service environment variable parsing and add unit tests for port detection logic

2025-11-11 11:19:33 +01:00

ServicePortSpecificVariablesTest.php

feat: implement service environment variable parsing and add unit tests for port detection logic

2025-11-11 11:19:33 +01:00

ServiceRequiredPortTest.php

test(factories): add missing model factories for app test suite

2026-03-03 09:50:05 +01:00

SshCommandInjectionTest.php

chore: prepare for PR

2026-03-03 11:51:38 +01:00

SshKeyValidationTest.php

fix(ssh): handle chmod failures gracefully and simplify key management

2026-03-16 21:27:10 +01:00

SshMultiplexingDisableTest.php

Fix SSH multiplexing contention for concurrent scheduled tasks (#6736)

2025-12-05 09:54:30 +01:00

SshRetryMechanismTest.php

fix(ssh): introduce SshRetryHandler and SshRetryable trait for enhanced SSH command retry logic with exponential backoff and error handling

2025-09-07 17:17:35 +02:00

StartKeydbConfigPermissionTest.php

chore: prepare for PR

2026-02-23 13:26:01 +01:00

StartProxyTest.php

fix(proxy): prevent "container name already in use" error during proxy restart

2025-11-18 14:53:49 +01:00

StartRedisConfigPermissionTest.php

chore: prepare for PR

2026-02-23 13:26:01 +01:00

StartupExecutionCleanupTest.php

feat(Cleanup): implement failure marking for stuck scheduled tasks and database backups during startup

2025-11-11 12:32:52 +01:00

StopProxyTest.php

fix(docker): migrate database start actions from --time to -t flag

2025-11-28 11:18:12 +01:00

StripCoolifyCustomFieldsTest.php

feat: add validation for YAML parsing, integer parameters, and Docker Compose custom fields

2025-11-20 18:34:49 +01:00

TimescaleDbDetectionTest.php

feat(ServiceDatabase): add support for TimescaleDB detection and database type identification

2025-11-12 00:36:38 +01:00

UnmanagedContainerCommandInjectionTest.php

fix(livewire): add input validation to unmanaged container operations

2026-03-25 20:42:00 +01:00

UpdateComposeAbbreviatedVariablesTest.php

fix: handle map-style environment variables in updateCompose

2025-11-21 11:21:49 +01:00

UpdateCoolifyTest.php

Fix: Fragile service name parsing in applyServiceApplicationPrerequisites

2025-11-28 17:42:04 +01:00

ValidateShellSafePathTest.php

refactor: harden and deduplicate validateShellSafePath

2025-10-16 09:51:37 +02:00

ValidationPatternsTest.php

feat(validation): make hostname validation case-insensitive and expand allowed characters

2026-03-24 08:03:08 +01:00

ValidGitRepositoryUrlTest.php

fix(validation): update git:// URL validation to support port numbers and tilde characters in paths

2025-09-29 12:21:15 +02:00

ValidHostnameTest.php

feat(validation): make hostname validation case-insensitive and expand allowed characters

2026-03-24 08:03:08 +01:00

ValidProxyConfigFilenameTest.php

Add ValidProxyConfigFilename rule for dynamic proxy config validation

2025-12-09 16:12:45 +01:00

VolumeArrayFormatSecurityTest.php

refactor: improve docker compose validation and transaction handling in StackForm

2025-11-07 14:03:19 +01:00

VolumeSecurityTest.php

refactor: improve docker compose validation and transaction handling in StackForm

2025-11-07 14:03:19 +01:00

WindowsPathVolumeTest.php

fix: use canonical parser for Windows path validation

2025-10-16 09:51:37 +02:00