From e160b5139a97e58160702d7f9ba77aec17bdd05c Mon Sep 17 00:00:00 2001 From: Cinzya Date: Wed, 22 Oct 2025 20:55:24 +0200 Subject: [PATCH 1/4] refactor: replace allowed IPs validation logic with regex --- app/Livewire/Settings/Advanced.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/Livewire/Settings/Advanced.php b/app/Livewire/Settings/Advanced.php index 832123d5a..adca1baa3 100644 --- a/app/Livewire/Settings/Advanced.php +++ b/app/Livewire/Settings/Advanced.php @@ -89,7 +89,7 @@ public function submit() $allowsFromAnywhere = false; if (empty($this->allowed_ips)) { $allowsFromAnywhere = true; - } elseif ($this->allowed_ips === '0.0.0.0' || str_contains($this->allowed_ips, '0.0.0.0')) { + } elseif ($this->allowed_ips === '0.0.0.0' || in_array('0.0.0.0', array_map('trim', explode(',', $this->allowed_ips)))) { $allowsFromAnywhere = true; } From b6782427803d9bc70472884b7ecd3356f8a0dab7 Mon Sep 17 00:00:00 2001 From: Cinzya Date: Wed, 22 Oct 2025 21:02:23 +0200 Subject: [PATCH 2/4] refactor: remove redundant --- app/Livewire/Settings/Advanced.php | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/app/Livewire/Settings/Advanced.php b/app/Livewire/Settings/Advanced.php index adca1baa3..1edfc9638 100644 --- a/app/Livewire/Settings/Advanced.php +++ b/app/Livewire/Settings/Advanced.php @@ -89,13 +89,8 @@ public function submit() $allowsFromAnywhere = false; if (empty($this->allowed_ips)) { $allowsFromAnywhere = true; - } elseif ($this->allowed_ips === '0.0.0.0' || in_array('0.0.0.0', array_map('trim', explode(',', $this->allowed_ips)))) { + } elseif (in_array('0.0.0.0', array_map('trim', explode(',', $this->allowed_ips)))) { $allowsFromAnywhere = true; - } - - // Check if it's 0.0.0.0 (allow all) or empty - if ($this->allowed_ips === '0.0.0.0' || empty($this->allowed_ips)) { - // Keep as is - empty means no restriction, 0.0.0.0 means allow all } else { // Validate and clean up the entries $invalidEntries = []; From 6e74317cb5ea76c6957ae26af6a167015e1b7622 Mon Sep 17 00:00:00 2001 From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com> Date: Sun, 26 Oct 2025 10:57:24 +0100 Subject: [PATCH 3/4] refactor: streamline allowed IPs validation and enhance UI warnings for API access --- app/Livewire/Settings/Advanced.php | 19 +-- .../livewire/settings/advanced.blade.php | 158 ++++++++++-------- 2 files changed, 89 insertions(+), 88 deletions(-) diff --git a/app/Livewire/Settings/Advanced.php b/app/Livewire/Settings/Advanced.php index 1edfc9638..be38ae1d8 100644 --- a/app/Livewire/Settings/Advanced.php +++ b/app/Livewire/Settings/Advanced.php @@ -85,14 +85,8 @@ public function submit() // Handle allowed IPs with subnet support and 0.0.0.0 special case $this->allowed_ips = str($this->allowed_ips)->replaceEnd(',', '')->trim(); - // Check if user entered 0.0.0.0 or left field empty (both allow access from anywhere) - $allowsFromAnywhere = false; - if (empty($this->allowed_ips)) { - $allowsFromAnywhere = true; - } elseif (in_array('0.0.0.0', array_map('trim', explode(',', $this->allowed_ips)))) { - $allowsFromAnywhere = true; - } else { - // Validate and clean up the entries + // Only validate and clean up if we have IPs and it's not 0.0.0.0 (allow all) + if (! empty($this->allowed_ips) && ! in_array('0.0.0.0', array_map('trim', explode(',', $this->allowed_ips)))) { $invalidEntries = []; $validEntries = str($this->allowed_ips)->trim()->explode(',')->map(function ($entry) use (&$invalidEntries) { $entry = str($entry)->trim()->toString(); @@ -128,7 +122,6 @@ public function submit() return; } - // Also check if we have no valid entries after filtering if ($validEntries->isEmpty()) { $this->dispatch('error', 'No valid IP addresses or subnets provided'); @@ -139,14 +132,6 @@ public function submit() } $this->instantSave(); - - // Show security warning if allowing access from anywhere - if ($allowsFromAnywhere) { - $message = empty($this->allowed_ips) - ? 'Empty IP allowlist allows API access from anywhere.

This is not recommended for production environments!' - : 'Using 0.0.0.0 allows API access from anywhere.

This is not recommended for production environments!'; - $this->dispatch('warning', $message); - } } catch (\Exception $e) { return handleError($e, $this); } diff --git a/resources/views/livewire/settings/advanced.blade.php b/resources/views/livewire/settings/advanced.blade.php index 65d7181c6..9ee15d17b 100644 --- a/resources/views/livewire/settings/advanced.blade.php +++ b/resources/views/livewire/settings/advanced.blade.php @@ -1,77 +1,93 @@
Advanced Settings | Coolify - - -
- -
-
-

Advanced

- - Save - -
-
Advanced settings for your Coolify instance.
- -
- - -

DNS Settings

- - -

API Settings

- - -

Confirmation Settings

-
- + + +
+ + +
+

Advanced

+ + Save +
-
-
- @if ($disable_two_step_confirmation) -
- +
Advanced settings for your Coolify instance.
+ +
+
+
- @else -
- - +
+
- - Disabling two step confirmation reduces security (as anyone can easily delete anything) and - increases the risk of accidental actions. This is not recommended for production servers. - - @endif -
- -
-
+

DNS Settings

+
+ +
+ + +

API Settings

+
+ +
+ + @if (empty($allowed_ips) || in_array('0.0.0.0', array_map('trim', explode(',', $allowed_ips ?? '')))) + + Using 0.0.0.0 allows API access from anywhere. This is not recommended for production + environments! + + @endif +

Confirmation Settings

+
+ +
+
+
+ @if ($disable_two_step_confirmation) +
+ +
+ @else +
+ + +
+ + Disabling two step confirmation reduces security (as anyone can easily delete anything) and + increases the risk of accidental actions. This is not recommended for production servers. + + @endif +
+ +
+
\ No newline at end of file From 1c33d131c77d017642b3ad8403f629eeec1f78d2 Mon Sep 17 00:00:00 2001 From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com> Date: Sun, 26 Oct 2025 10:59:28 +0100 Subject: [PATCH 4/4] fix: clarify warning message for allowed IPs configuration --- resources/views/livewire/settings/advanced.blade.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/views/livewire/settings/advanced.blade.php b/resources/views/livewire/settings/advanced.blade.php index 9ee15d17b..c47c2cfef 100644 --- a/resources/views/livewire/settings/advanced.blade.php +++ b/resources/views/livewire/settings/advanced.blade.php @@ -46,7 +46,7 @@ class="flex flex-col h-full gap-8 sm:flex-row"> placeholder="192.168.1.100,10.0.0.0/8,203.0.113.0/24" /> @if (empty($allowed_ips) || in_array('0.0.0.0', array_map('trim', explode(',', $allowed_ips ?? '')))) - Using 0.0.0.0 allows API access from anywhere. This is not recommended for production + Using 0.0.0.0 (or empty) allows API access from anywhere. This is not recommended for production environments! @endif