Files
coolify/app/Livewire/Server/Transfer.php
T
Andras BacsaiandClaude Opus 5.5 cf9f254507 fix(server-transfer): close security holes in import, claim, and archives
Import:
- Check every uuid in a bundle against a strict id format before any
  write, and quote the SSH mux socket and key paths in local shell
  commands. A bundle uuid could run commands in the Coolify container.
- Validate bundle fqdns, git source URLs, paths, networks, cron
  expressions, and database ports; cap the number of items.
- Do not confirm that another team has a uuid.
- Refuse a project icon path with a uuid that is not a plain id.

Claim, finish, and migrate:
- Pass checklist step keys to wire:click with Js::from (stored XSS).
- Link only to https target server URLs.
- Validate target_instance_url in /transfer/complete; never prefill an
  unverified URL for a transfer back; scope the transfer-back token to
  write+deploy for 1 hour.
- Release on an owner marker only when it is newer than the own claim.
- Do not touch apps that only use the server as an additional
  destination when an archive is released or deleted.
- Give Sentinel a new token on claim.
- Add a checklist step to remove the previous instance's SSH key.
- Block a transfer while backups or scheduled tasks run.
- Authorize refreshMigration and PrivateKey checkConnection, clear
  tokens from Livewire state, hide migration log/error from members.

Archives:
- Refuse ip, user, port, private key, and Cloudflare tunnel changes.
- Throttle Enable management and require a free server slot for it and
  for a transfer back.
- Skip cloud provider calls.
- Re-read force_disabled before each SSH command, so running jobs stop.
- Probe the import check target at the resolved address only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-23 21:02:32 +02:00

161 lines
5.2 KiB
PHP

<?php
namespace App\Livewire\Server;
use App\Models\Server;
use App\Services\ServerTransfer\ServerTransferMigrator;
use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
use Livewire\Component;
use Throwable;
class Transfer extends Component
{
use AuthorizesRequests;
public Server $server;
/** Primary one-click migrate fields */
public string $targetUrl = '';
public string $targetToken = '';
public ?string $exportId = null;
/** Transfer back fields, shown for an archive */
public string $managerUrl = '';
public string $managerToken = '';
public string $thisInstanceUrl = '';
/** @var list<string> */
public array $lastWarnings = [];
public function mount(string $server_uuid): void
{
try {
$this->server = Server::ownedByCurrentTeam()->whereUuid($server_uuid)->firstOrFail();
// The transfer exports every credential of the server, so only admins and owners may open it.
$this->authorize('update', $this->server);
$this->exportId = data_get($this->server->server_metadata, 'transfer.export_id');
// Transfer back sends a new team token to this URL, so it is prefilled only when this instance chose it.
$managerUrl = data_get($this->server->server_metadata, 'transfer.target_instance_url');
if (is_string($managerUrl) && ! data_get($this->server->server_metadata, 'transfer.claimed_by_marker')
&& ServerTransferMigrator::isValidInstanceUrl($managerUrl)) {
$this->managerUrl = $managerUrl;
}
$this->thisInstanceUrl = rtrim((string) (instanceSettings()->fqdn ?: config('app.url')), '/');
} catch (Throwable $e) {
handleError($e, $this);
$this->redirect(route('server.index'), navigate: true);
}
}
public function getIsLocalhostProperty(): bool
{
return (int) $this->server->id === 0;
}
/**
* State of the queued transfer to another instance, read by the page poll.
*
* @return array<string, mixed>|null
*/
public function getMigrationProperty(): ?array
{
$migration = data_get($this->server->server_metadata, 'migration');
return is_array($migration) ? $migration : null;
}
/**
* Manual steps of a finished transfer that the target instance cannot do.
*
* @return list<string>
*/
public function getPostTransferChecklistProperty(): array
{
if (data_get($this->migration, 'status') !== 'succeeded') {
return [];
}
return array_values(array_filter((array) data_get($this->migration, 'checklist', []), 'is_string'));
}
/**
* The link to the server on the target. The target sends it, so only an https link is shown.
*/
public function getTargetServerUrlProperty(): ?string
{
$url = data_get($this->migration, 'target_server_url');
return ServerTransferMigrator::isLinkableUrl($url) ? $url : null;
}
public function refreshMigration(): void
{
$this->authorize('update', $this->server);
$this->server->refresh();
$this->lastWarnings = array_values((array) data_get($this->migration, 'warnings', $this->lastWarnings));
}
public function migrateServer(ServerTransferMigrator $migrator): void
{
try {
$this->authorize('update', $this->server);
if ($this->isLocalhost) {
throw new \RuntimeException('The Coolify host (localhost) cannot be transferred.');
}
$migrator->start(
server: $this->server,
targetUrl: $this->targetUrl,
targetToken: $this->targetToken,
);
auditLog('ui.server.migrate', [
'team_id' => $this->server->team_id,
'server_uuid' => $this->server->uuid,
'target_url' => $this->targetUrl,
]);
$this->server->refresh();
$this->lastWarnings = [];
$this->dispatch('success', 'All checks passed. The transfer started.');
} catch (Throwable $e) {
// A failed check is saved in the transfer log, so show it.
$this->server->refresh();
handleError($e, $this);
} finally {
// Public properties are sent to the browser with every response.
$this->targetToken = '';
}
}
public function transferBack(ServerTransferMigrator $migrator): void
{
try {
$this->authorize('update', $this->server);
$migrator->requestTransferBack($this->server, auth()->user(), $this->managerUrl, $this->managerToken, $this->thisInstanceUrl);
auditLog('ui.server.transfer_back', [
'team_id' => $this->server->team_id,
'server_uuid' => $this->server->uuid,
'from' => $this->managerUrl,
]);
$this->server->refresh();
$this->dispatch('success', 'The other instance started the transfer back.');
} catch (Throwable $e) {
handleError($e, $this);
} finally {
$this->managerToken = '';
}
}
public function render()
{
return view('livewire.server.transfer');
}
}