Add validation to ensure sentinel tokens contain only safe characters (alphanumeric, dots, hyphens, underscores, plus, forward slash, equals), preventing OS command injection vulnerabilities when tokens are interpolated into shell commands. - Add ServerSetting::isValidSentinelToken() validation method - Validate tokens in StartSentinel action and metrics queries - Improve shell argument escaping with escapeshellarg() - Add comprehensive test coverage for token validation |
||
|---|---|---|
| .. | ||
| CheckUpdates.php | ||
| CleanupDocker.php | ||
| ConfigureCloudflared.php | ||
| DeleteServer.php | ||
| InstallDocker.php | ||
| InstallPrerequisites.php | ||
| ResourcesCheck.php | ||
| RestartContainer.php | ||
| RunCommand.php | ||
| StartLogDrain.php | ||
| StartSentinel.php | ||
| StopLogDrain.php | ||
| StopSentinel.php | ||
| UpdateCoolify.php | ||
| UpdatePackage.php | ||
| ValidatePrerequisites.php | ||
| ValidateServer.php | ||