mirror of
https://github.com/tiennm99/coolify.git
synced 2026-10-20 02:17:09 +00:00
fix: add authorization checks to database Livewire components
Added authorization checks to 11 database-related Livewire components
that were loading sensitive database configuration without verifying
user permissions.
Changes:
- Added authorize('view', $database) to all 8 database type General.php mount() methods
- Added authorization to Configuration.php before loading database
- Added authorization to BackupEdit.php before loading backup config
- Added authorization to Import.php before loading database resource
This prevents unauthorized users from accessing database credentials,
connection strings, and configuration details.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
1 parent
a3d9ca5c5c
commit
e20327b9c4
11 files changed
+14
No files matched your search
@@ -85,6 +85,7 @@ class BackupEdit extends Component
|
|||||||
public function mount()
|
public function mount()
|
||||||
{
|
{
|
||||||
try {
|
try {
|
||||||
|
$this->authorize('view', $this->backup->database);
|
||||||
$this->parameters = get_route_parameters();
|
$this->parameters = get_route_parameters();
|
||||||
$this->syncData();
|
$this->syncData();
|
||||||
} catch (Exception $e) {
|
} catch (Exception $e) {
|
||||||
|
|||||||
@@ -56,6 +56,7 @@ class General extends Component
|
|||||||
public function mount()
|
public function mount()
|
||||||
{
|
{
|
||||||
try {
|
try {
|
||||||
|
$this->authorize('view', $this->database);
|
||||||
$this->syncData();
|
$this->syncData();
|
||||||
$this->server = data_get($this->database, 'destination.server');
|
$this->server = data_get($this->database, 'destination.server');
|
||||||
if (! $this->server) {
|
if (! $this->server) {
|
||||||
|
|||||||
@@ -3,10 +3,12 @@
|
|||||||
namespace App\Livewire\Project\Database;
|
namespace App\Livewire\Project\Database;
|
||||||
|
|
||||||
use Auth;
|
use Auth;
|
||||||
|
use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
|
||||||
use Livewire\Component;
|
use Livewire\Component;
|
||||||
|
|
||||||
class Configuration extends Component
|
class Configuration extends Component
|
||||||
{
|
{
|
||||||
|
use AuthorizesRequests;
|
||||||
public $currentRoute;
|
public $currentRoute;
|
||||||
|
|
||||||
public $database;
|
public $database;
|
||||||
@@ -42,6 +44,8 @@ class Configuration extends Component
|
|||||||
->where('uuid', request()->route('database_uuid'))
|
->where('uuid', request()->route('database_uuid'))
|
||||||
->firstOrFail();
|
->firstOrFail();
|
||||||
|
|
||||||
|
$this->authorize('view', $database);
|
||||||
|
|
||||||
$this->database = $database;
|
$this->database = $database;
|
||||||
$this->project = $project;
|
$this->project = $project;
|
||||||
$this->environment = $environment;
|
$this->environment = $environment;
|
||||||
|
|||||||
@@ -62,6 +62,7 @@ class General extends Component
|
|||||||
public function mount()
|
public function mount()
|
||||||
{
|
{
|
||||||
try {
|
try {
|
||||||
|
$this->authorize('view', $this->database);
|
||||||
$this->syncData();
|
$this->syncData();
|
||||||
$this->server = data_get($this->database, 'destination.server');
|
$this->server = data_get($this->database, 'destination.server');
|
||||||
if (! $this->server) {
|
if (! $this->server) {
|
||||||
|
|||||||
@@ -131,6 +131,7 @@ EOD;
|
|||||||
if (is_null($resource)) {
|
if (is_null($resource)) {
|
||||||
abort(404);
|
abort(404);
|
||||||
}
|
}
|
||||||
|
$this->authorize('view', $resource);
|
||||||
$this->resource = $resource;
|
$this->resource = $resource;
|
||||||
$this->server = $this->resource->destination->server;
|
$this->server = $this->resource->destination->server;
|
||||||
$this->container = $this->resource->uuid;
|
$this->container = $this->resource->uuid;
|
||||||
|
|||||||
@@ -64,6 +64,7 @@ class General extends Component
|
|||||||
public function mount()
|
public function mount()
|
||||||
{
|
{
|
||||||
try {
|
try {
|
||||||
|
$this->authorize('view', $this->database);
|
||||||
$this->syncData();
|
$this->syncData();
|
||||||
$this->server = data_get($this->database, 'destination.server');
|
$this->server = data_get($this->database, 'destination.server');
|
||||||
if (! $this->server) {
|
if (! $this->server) {
|
||||||
|
|||||||
@@ -122,6 +122,7 @@ class General extends Component
|
|||||||
public function mount()
|
public function mount()
|
||||||
{
|
{
|
||||||
try {
|
try {
|
||||||
|
$this->authorize('view', $this->database);
|
||||||
$this->syncData();
|
$this->syncData();
|
||||||
$this->server = data_get($this->database, 'destination.server');
|
$this->server = data_get($this->database, 'destination.server');
|
||||||
if (! $this->server) {
|
if (! $this->server) {
|
||||||
|
|||||||
@@ -122,6 +122,7 @@ class General extends Component
|
|||||||
public function mount()
|
public function mount()
|
||||||
{
|
{
|
||||||
try {
|
try {
|
||||||
|
$this->authorize('view', $this->database);
|
||||||
$this->syncData();
|
$this->syncData();
|
||||||
$this->server = data_get($this->database, 'destination.server');
|
$this->server = data_get($this->database, 'destination.server');
|
||||||
if (! $this->server) {
|
if (! $this->server) {
|
||||||
|
|||||||
@@ -127,6 +127,7 @@ class General extends Component
|
|||||||
public function mount()
|
public function mount()
|
||||||
{
|
{
|
||||||
try {
|
try {
|
||||||
|
$this->authorize('view', $this->database);
|
||||||
$this->syncData();
|
$this->syncData();
|
||||||
$this->server = data_get($this->database, 'destination.server');
|
$this->server = data_get($this->database, 'destination.server');
|
||||||
if (! $this->server) {
|
if (! $this->server) {
|
||||||
|
|||||||
@@ -140,6 +140,7 @@ class General extends Component
|
|||||||
public function mount()
|
public function mount()
|
||||||
{
|
{
|
||||||
try {
|
try {
|
||||||
|
$this->authorize('view', $this->database);
|
||||||
$this->syncData();
|
$this->syncData();
|
||||||
$this->server = data_get($this->database, 'destination.server');
|
$this->server = data_get($this->database, 'destination.server');
|
||||||
if (! $this->server) {
|
if (! $this->server) {
|
||||||
|
|||||||
@@ -115,6 +115,7 @@ class General extends Component
|
|||||||
public function mount()
|
public function mount()
|
||||||
{
|
{
|
||||||
try {
|
try {
|
||||||
|
$this->authorize('view', $this->database);
|
||||||
$this->syncData();
|
$this->syncData();
|
||||||
$this->server = data_get($this->database, 'destination.server');
|
$this->server = data_get($this->database, 'destination.server');
|
||||||
if (! $this->server) {
|
if (! $this->server) {
|
||||||
|
|||||||
Reference in new issue
Block a user