Dokploy/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy synced 2025-06-26 18:27:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: add authorization checks in GitHub router to include userId validation

Browse Source 
- Updated conditional checks to ensure that the GitHub provider's userId matches the session userId, in addition to the organizationId, for improved security and access control.
This commit is contained in:
ayham291
2025-06-01 20:53:54 +02:00
parent 8436d364be
commit 56d21aff60
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
apps/dokploy/server/api/routers/github.ts
View File

@@ -21,7 +21,8 @@ export const githubRouter = createTRPCRouter({
const githubProvider = await findGithubById(input.githubId); const githubProvider = await findGithubById(input.githubId);
if ( if (
githubProvider.gitProvider.organizationId !== githubProvider.gitProvider.organizationId !==
ctx.session.activeOrganizationId ctx.session.activeOrganizationId &&
githubProvider.gitProvider.userId === ctx.session.userId
) { ) {
throw new TRPCError({ throw new TRPCError({
code: "UNAUTHORIZED", code: "UNAUTHORIZED",
@@ -36,7 +37,8 @@ export const githubRouter = createTRPCRouter({
const githubProvider = await findGithubById(input.githubId); const githubProvider = await findGithubById(input.githubId);
if ( if (
githubProvider.gitProvider.organizationId !== githubProvider.gitProvider.organizationId !==
ctx.session.activeOrganizationId ctx.session.activeOrganizationId &&
githubProvider.gitProvider.userId === ctx.session.userId
) { ) {
throw new TRPCError({ throw new TRPCError({
code: "UNAUTHORIZED", code: "UNAUTHORIZED",
@@ -51,7 +53,8 @@ export const githubRouter = createTRPCRouter({
const githubProvider = await findGithubById(input.githubId || ""); const githubProvider = await findGithubById(input.githubId || "");
if ( if (
githubProvider.gitProvider.organizationId !== githubProvider.gitProvider.organizationId !==
ctx.session.activeOrganizationId ctx.session.activeOrganizationId &&
githubProvider.gitProvider.userId === ctx.session.userId
) { ) {
//TODO: Remove this line when the cloud version is ready //TODO: Remove this line when the cloud version is ready
throw new TRPCError({ throw new TRPCError({
@@ -71,7 +74,8 @@ export const githubRouter = createTRPCRouter({
result = result.filter( result = result.filter(
(provider) => (provider) =>
provider.gitProvider.organizationId === provider.gitProvider.organizationId ===
ctx.session.activeOrganizationId, ctx.session.activeOrganizationId &&
provider.gitProvider.userId === ctx.session.userId
); );
const filtered = result const filtered = result
@@ -95,7 +99,8 @@ export const githubRouter = createTRPCRouter({
const githubProvider = await findGithubById(input.githubId); const githubProvider = await findGithubById(input.githubId);
if ( if (
githubProvider.gitProvider.organizationId !== githubProvider.gitProvider.organizationId !==
ctx.session.activeOrganizationId ctx.session.activeOrganizationId &&
githubProvider.gitProvider.userId === ctx.session.userId
) { ) {
throw new TRPCError({ throw new TRPCError({
code: "UNAUTHORIZED", code: "UNAUTHORIZED",
@@ -117,7 +122,8 @@ export const githubRouter = createTRPCRouter({
const githubProvider = await findGithubById(input.githubId); const githubProvider = await findGithubById(input.githubId);
if ( if (
githubProvider.gitProvider.organizationId !== githubProvider.gitProvider.organizationId !==
ctx.session.activeOrganizationId ctx.session.activeOrganizationId &&
githubProvider.gitProvider.userId === ctx.session.userId
) { ) {
throw new TRPCError({ throw new TRPCError({
code: "UNAUTHORIZED", code: "UNAUTHORIZED",