Andras Bacsai
43f33d94ad
Merge remote-tracking branch 'origin/next' into audit-policies
...
# Conflicts:
# app/Http/Controllers/Api/SecurityController.php
# app/Http/Controllers/Api/ServersController.php
# app/Livewire/Admin/Index.php
# app/Livewire/Destination/Show.php
# app/Livewire/NavbarDeleteTeam.php
# app/Livewire/Project/Application/Previews.php
# app/Livewire/Project/DeleteProject.php
# app/Livewire/Project/Shared/ResourceOperations.php
# app/Livewire/Server/Resources.php
# app/Livewire/Server/ValidateAndInstall.php
# app/Livewire/Storage/Show.php
# resources/views/livewire/dashboard.blade.php
# resources/views/livewire/project/application/heading.blade.php
# resources/views/livewire/project/database/heading.blade.php
# resources/views/livewire/project/service/heading.blade.php
# resources/views/livewire/project/shared/environment-variable/show.blade.php
# resources/views/livewire/project/shared/scheduled-task/show.blade.php
# tests/Feature/Security/TrustHostsMiddlewareTest.php
2026-04-19 15:19:37 +02:00
Andras Bacsai
b3256d4df1
fix(security): harden model assignment and sensitive data handling
...
Restrict mass-assignable attributes across user/team/redis models and
switch privileged root/team creation paths to forceFill/forceCreate.
Encrypt legacy ClickHouse admin passwords via migration and cast the
correct ClickHouse password field as encrypted.
Tighten API and runtime exposure by removing sensitive team fields from
responses and sanitizing Git/compose error messages.
Expand security-focused feature coverage for command-injection and mass
assignment protections.
2026-03-29 20:56:04 +02:00
Andras Bacsai
86b05b902a
fix(auth): enforce authorization checks across API and Livewire components
...
- Add authorization checks to API controller endpoints (view, create, update, delete)
- Wrap Livewire component methods with try-catch for consistent error handling
- Add AuthorizesRequests trait to components requiring authorization checks
- Ensure all sensitive operations verify user permissions before execution
- Implement unified error handling with handleError() helper function
2026-02-25 14:20:29 +01:00
Andras Bacsai
8d212bc110
fix(team): improve team retrieval and session handling for users
2025-12-28 14:50:59 +01:00
Yihang Wang
844a67a006
fix: hide sensitive email change fields in team member responses
2025-09-18 00:40:09 +08:00
Andras Bacsai
3fa7d03db7
fix: root + read:sensive could read senstive data with a middlewarew
2024-12-09 11:10:35 +01:00
Kael
6520235667
middleware should allow, not deny
2024-10-30 19:06:50 +11:00
Andras Bacsai
25480fe624
fix: openapi endpoint urls
2024-09-04 10:09:10 +02:00
Andras Bacsai
33b965d9db
chore: more details
2024-07-09 13:59:54 +02:00
Andras Bacsai
2d3a6a4528
openapi work work
2024-07-09 10:45:10 +02:00
Andras Bacsai
9c821e2480
init openapi generator
2024-07-06 14:34:15 +02:00
Andras Bacsai
88ab385100
test openapi
2024-07-05 16:08:01 +02:00
Andras Bacsai
b24a489c77
fix: api updates
2024-07-03 13:13:38 +02:00
Andras Bacsai
c39d6dd407
feat: token permissions
...
feat: handle sensitive data
feat: handle read-only data
2024-07-02 12:15:58 +02:00
Andras Bacsai
da6f2da3d0
feat: lots of api endpoints
2024-07-01 16:26:50 +02:00
