coolify

starred/coolify

Fork 0

mirror of https://github.com/coollabsio/coolify.git synced 2026-11-14 16:52:45 -04:00

Files

T

History

Andras BacsaiandClaude Opus 5.5 0448c6ca51 refactor(http): remove the TrustHosts middleware that never checked the host

TrustHosts skipped its check while the cache key instance_settings_fqdn_host
was empty, and only the skipped check filled that key. So since e1fe58639
(October 2025) no release restricted the Host header. Turning it on now would
lock out users who reach Coolify by server IP or another name when the domain
or proxy is broken.

Links in emails and notifications do not use the Host header: base_url()
uses the configured FQDN or the server IP (see ResetPasswordUrlTest). So
remove the middleware, its cache key and its tests. TrustProxies is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-28 12:00:16 +02:00

AddServerTimingHeaders.php

feat(ui): Shadow UI redesign, domain management, and DNS autoconfigure (#11119 )

2026-08-03 23:11:54 +02:00

ApiAbility.php

Merge remote-tracking branch 'origin/next' into audit-policies

2026-05-11 21:13:57 +02:00

ApiAllowed.php

refactor(dns-validation): rename DNS validation functions for consistency and clarity, and remove unused code

2025-09-09 09:00:35 +02:00

ApiSensitiveData.php

fix(api): expose sensitive fields for privileged tokens