Merge pull request #4859 from Dokploy/fix/idor-application-one-secret-redaction

fix(security): git provider secret disclosure via application.one
2026-07-21 13:55:33 +02:00 · 2026-07-19 21:46:29 -06:00
parent 65fe737bc4 ecbaf6060b
commit 1c31ed9969
1 changed files with 18 additions and 4 deletions
--- a/packages/server/src/services/application.ts
+++ b/packages/server/src/services/application.ts
@@ -102,10 +102,24 @@ export const findApplicationById = async (applicationId: string) => {
 			redirects: true,
 			security: true,
 			ports: true,
-			gitlab: true,
-			github: true,
-			bitbucket: true,
-			gitea: true,
+			gitlab: {
+				columns: { secret: false, accessToken: false, refreshToken: false },
+			},
+			github: {
+				columns: {
+					githubClientSecret: false,
+					githubPrivateKey: false,
+					githubWebhookSecret: false,
+				},
+			},
+			bitbucket: { columns: { appPassword: false, apiToken: false } },
+			gitea: {
+				columns: {
+					clientSecret: false,
+					accessToken: false,
+					refreshToken: false,
+				},
+			},
 			server: true,
 			previewDeployments: true,
 			registry: { columns: { password: false } },