tiennm99/coolify
1
0 Fork 0
mirror of https://github.com/tiennm99/coolify.git synced 2026-10-15 06:16:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): hide notification secrets from non-admins

Browse Source 
Prevent users without update permission from reading notification credentials and manual webhook secrets in Livewire state or rendered forms.
This commit is contained in:
Andras Bacsai committed 2026-06-04 11:24:19 +02:00
1 parent 062ad57740
commit 5973bb4d4f
14 files changed
+219 -45
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

resources/views/livewire/project/shared/webhooks.blade.php
+8 -8
View File
@@ -22,9 +22,9 @@
helper="Need to set a secret to be able to use this webhook. It should match with the secret in GitHub."
label="GitHub Webhook Secret" id="githubManualWebhookSecret"></x-forms.input>
@else
<x-forms.input disabled type="password"
<x-forms.input disabled
helper="Need to set a secret to be able to use this webhook. It should match with the secret in GitHub."
label="GitHub Webhook Secret" id="githubManualWebhookSecret"></x-forms.input>
label="GitHub Webhook Secret" value="Hidden (only admins can view)"></x-forms.input>
@endcan
</div>
<a target="_blank" class="flex hover:no-underline" href="{{ $resource?->gitWebhook }}">
@@ -39,9 +39,9 @@
helper="Need to set a secret to be able to use this webhook. It should match with the secret in GitLab."
label="GitLab Webhook Secret" id="gitlabManualWebhookSecret"></x-forms.input>
@else
<x-forms.input disabled type="password"
<x-forms.input disabled
helper="Need to set a secret to be able to use this webhook. It should match with the secret in GitLab."
label="GitLab Webhook Secret" id="gitlabManualWebhookSecret"></x-forms.input>
label="GitLab Webhook Secret" value="Hidden (only admins can view)"></x-forms.input>
@endcan
</div>
<div class="flex gap-2">
@@ -51,9 +51,9 @@
helper="Need to set a secret to be able to use this webhook. It should match with the secret in Bitbucket."
label="Bitbucket Webhook Secret" id="bitbucketManualWebhookSecret"></x-forms.input>
@else
<x-forms.input disabled type="password"
<x-forms.input disabled
helper="Need to set a secret to be able to use this webhook. It should match with the secret in Bitbucket."
label="Bitbucket Webhook Secret" id="bitbucketManualWebhookSecret"></x-forms.input>
label="Bitbucket Webhook Secret" value="Hidden (only admins can view)"></x-forms.input>
@endcan
</div>
<div class="flex gap-2">
@@ -63,9 +63,9 @@
helper="Need to set a secret to be able to use this webhook. It should match with the secret in Gitea."
label="Gitea Webhook Secret" id="giteaManualWebhookSecret"></x-forms.input>
@else
<x-forms.input disabled type="password"
<x-forms.input disabled
helper="Need to set a secret to be able to use this webhook. It should match with the secret in Gitea."
label="Gitea Webhook Secret" id="giteaManualWebhookSecret"></x-forms.input>
label="Gitea Webhook Secret" value="Hidden (only admins can view)"></x-forms.input>
@endcan
</div>
@can('update', $resource)