starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-11-06 13:10:37 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): stop leaking locked shared variables and proxy secrets

Browse Source 
- References to locked (shown once) shared variables keep their reference
  text in the UI, copy action, and API instead of the locked value.
- Remove the saved proxy configuration and validation logs from nested
  servers (for example destination.server) in API responses unless the
  token can read sensitive data.
- The services list API now applies removeSensitiveData to every service.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Andras Bacsai
2026-10-02 16:01:00 +02:00
co-authored by Claude Opus 5.5
parent a5ec854e35
commit aa2592b17c
7 changed files with 423 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Controllers/Api/ServicesController.php
+5 -5
View File
@@ -272,13 +272,13 @@ class ServicesController extends Controller
: [];
foreach ($projects as $project) {
$services->push($project->services()->with($serviceRelations)->get());
}
foreach ($services as $service) {
$service = $this->removeSensitiveData($service);
$services = $services->merge(
$project->services()->with($serviceRelations)->get()
->map(fn (Service $service) => $this->removeSensitiveData($service))
);
}
return response()->json($services->flatten());
return response()->json($services->values());
}
#[OA\Post(