Dokploy/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-07-21 13:55:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4874 from Dokploy/fix/idor-server-remove

Browse Source 
fix(security): cross-org authorization bypass in server.remove
This commit is contained in:
Mauricio Siu
2026-07-20 17:40:18 -06:00
committed by GitHub
parent ffe62bca0e 4aee66b2d1
commit b2ade17487
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
apps/dokploy/server/api/routers/server.ts
View File

@@ -413,6 +413,14 @@ export const serverRouter = createTRPCRouter({
.input(apiRemoveServer)
.mutation(async ({ input, ctx }) => {
try {
const currentServer = await findServerById(input.serverId);
if (currentServer.organizationId !== ctx.session.activeOrganizationId) {
throw new TRPCError({
code: "UNAUTHORIZED",
message: "You are not authorized to delete this server",
});
}
const activeServers = await haveActiveServices(input.serverId);
if (activeServers) {
@@ -421,7 +429,6 @@ export const serverRouter = createTRPCRouter({
message: "Server has active services, please delete them first",
});
}
const currentServer = await findServerById(input.serverId);
await audit(ctx, {
action: "delete",
resourceType: "server",