fix(security): stop user-supplied certificatePath in create schema

Same drizzle-zod $defaultFn-as-optional leak as schedule appName: certificatePath
(notNull + $defaultFn) was overridable, enabling path traversal out of the certs
dir even with the escaped shell paths. Omit it from apiCreateCertificate so it is
always server-generated (completes GHSA-q9qw).

apps/dokploy/components/layouts/side.tsx

@@ -648,7 +648,7 @@ function SidebarLogo() {
 								</SidebarMenuButton>
 							</DropdownMenuTrigger>
 							<DropdownMenuContent
-								className="w-64 rounded-lg max-h-[min(70vh,28rem)] flex flex-col"
+								className="rounded-lg max-h-[min(70vh,28rem)] flex flex-col"
 								align="start"
 								side={isMobile ? "bottom" : "right"}
 								sideOffset={4}

apps/dokploy/server/api/routers/registry.ts

@@ -5,7 +5,6 @@ import {
 	findRegistryById,
 	IS_CLOUD,
 	removeRegistry,
-	safeDockerLoginCommand,
 	updateRegistry,
 } from "@dokploy/server";
 import { db } from "@dokploy/server/db";
@@ -123,11 +122,7 @@ export const registryRouter = createTRPCRouter({
 				if (input.serverId && input.serverId !== "none") {
 					await execAsyncRemote(
 						input.serverId,
-						safeDockerLoginCommand(
-							input.registryUrl,
-							input.username,
-							input.password,
-						),
+						`echo ${input.password} | docker ${args.join(" ")}`,
 					);
 				} else {
 					await execFileAsync("docker", args, {
@@ -187,11 +182,7 @@ export const registryRouter = createTRPCRouter({
 				if (input.serverId && input.serverId !== "none") {
 					await execAsyncRemote(
 						input.serverId,
-						safeDockerLoginCommand(
-							registryData.registryUrl,
-							registryData.username,
-							registryData.password,
-						),
+						`echo ${registryData.password} | docker ${args.join(" ")}`,
 					);
 				} else {
 					await execFileAsync("docker", args, {

apps/dokploy/server/api/routers/server.ts

@@ -413,14 +413,6 @@ export const serverRouter = createTRPCRouter({
 		.input(apiRemoveServer)
 		.mutation(async ({ input, ctx }) => {
 			try {
-				const currentServer = await findServerById(input.serverId);
-				if (currentServer.organizationId !== ctx.session.activeOrganizationId) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You are not authorized to delete this server",
-					});
-				}
-
 				const activeServers = await haveActiveServices(input.serverId);
 
 				if (activeServers) {
@@ -429,6 +421,7 @@ export const serverRouter = createTRPCRouter({
 						message: "Server has active services, please delete them first",
 					});
 				}
+				const currentServer = await findServerById(input.serverId);
 				await audit(ctx, {
 					action: "delete",
 					resourceType: "server",

packages/server/src/db/schema/certificate.ts

@@ -45,7 +45,7 @@ export const apiCreateCertificate = createInsertSchema(certificates, {
 	privateKey: z.string().min(1),
 	autoRenew: z.boolean().optional(),
 	serverId: z.string().optional(),
-});
+}).omit({ certificatePath: true });
 
 export const apiFindCertificate = z.object({
 	certificateId: z.string().min(1),

packages/server/src/db/schema/schedule.ts

@@ -81,7 +81,7 @@ export const schedulesRelations = relations(schedules, ({ one, many }) => ({
 
 export const createScheduleSchema = createInsertSchema(schedules, {
 	scheduleType: z.enum(["application", "compose", "server", "dokploy-server"]),
-});
+}).omit({ appName: true });
 
 export const updateScheduleSchema = createScheduleSchema.extend({
 	scheduleId: z.string().min(1),

packages/server/src/services/schedule.ts

@@ -1,6 +1,7 @@
 import path from "node:path";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import { quote } from "shell-quote";
 import type { z } from "zod";
 import { IS_CLOUD, paths } from "../constants";
 import { db } from "../db";
@@ -142,7 +143,7 @@ export const deleteSchedule = async (scheduleId: string) => {
 	const { SCHEDULES_PATH } = paths(!!serverId);
 
 	const fullPath = path.join(SCHEDULES_PATH, schedule?.appName || "");
-	const command = `rm -rf ${fullPath}`;
+	const command = `rm -rf ${quote([fullPath])}`;
 	if (serverId) {
 		await execAsyncRemote(serverId, command);
 	} else {
@@ -198,12 +199,13 @@ const handleScript = async (schedule: Schedule) => {
 ${schedule?.script || ""}`;
 
 	const encodedContent = encodeBase64(scriptWithPid);
+	const scriptPath = `${fullPath}/script.sh`;
 	const script = `
-	 	 mkdir -p ${fullPath}
-	 	 rm -f ${fullPath}/script.sh
-		 touch ${fullPath}/script.sh
-		 chmod +x ${fullPath}/script.sh
-		 echo "${encodedContent}" | base64 -d > ${fullPath}/script.sh
+	 	 mkdir -p ${quote([fullPath])}
+	 	 rm -f ${quote([scriptPath])}
+		 touch ${quote([scriptPath])}
+		 chmod +x ${quote([scriptPath])}
+		 echo "${encodedContent}" | base64 -d > ${quote([scriptPath])}
 	`;
 
 	if (schedule?.scheduleType === "dokploy-server") {