Dokploy/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-07-21 22:05:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4858 from Dokploy/fix/idor-swarm-cross-org

Browse Source 
fix(security): cross-org IDOR + nodeId injection in swarm read endpoints
This commit is contained in:
Mauricio Siu
2026-07-19 21:28:53 -06:00
committed by GitHub
parent c2c0e9c1c2 182d3656bb
commit 65fe737bc4
3 changed files with 83 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
packages/server/src/services/docker.ts
View File

@@ -2,6 +2,7 @@ import {
execAsync,
execAsyncRemote,
} from "@dokploy/server/utils/process/execAsync";
import { quote } from "shell-quote";
export const getContainers = async (serverId?: string | null) => {
try {
@@ -519,7 +520,7 @@ export const getSwarmNodes = async (serverId?: string) => {
export const getNodeInfo = async (nodeId: string, serverId?: string) => {
try {
const command = `docker node inspect ${nodeId} --format '{{json .}}'`;
const command = `docker node inspect ${quote([nodeId])} --format '{{json .}}'`;
let stdout = "";
let stderr = "";
if (serverId) {