Dokploy/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-07-21 13:55:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): enforce organization ownership on server.remove

Browse Source 
server.remove deleted a server (and its deployment rows) by caller-supplied
serverId without checking it belongs to the active organization, unlike server.one
and server.update. An owner/admin of org A could delete org B's server registration.
Resolve and compare the server's organizationId before the active-services guard,
so cross-org callers are rejected without leaking existence.
This commit is contained in:
Mauricio Siu
2026-07-20 17:14:35 -06:00
parent d02f34f9d4
commit 4aee66b2d1
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
apps/dokploy/server/api/routers/server.ts
View File

@@ -413,6 +413,14 @@ export const serverRouter = createTRPCRouter({
.input(apiRemoveServer)
.mutation(async ({ input, ctx }) => {
try {
const currentServer = await findServerById(input.serverId);
if (currentServer.organizationId !== ctx.session.activeOrganizationId) {
throw new TRPCError({
code: "UNAUTHORIZED",
message: "You are not authorized to delete this server",
});
}
const activeServers = await haveActiveServices(input.serverId);
if (activeServers) {
@@ -421,7 +429,6 @@ export const serverRouter = createTRPCRouter({
message: "Server has active services, please delete them first",
});
}
const currentServer = await findServerById(input.serverId);
await audit(ctx, {
action: "delete",
resourceType: "server",