Mauricio Siu 071d9eacee fix(security): enforce org-scope on git provider read endpoints ...

The .one / getRepositories / getBranches / testConnection handlers for
github, gitlab, gitea and bitbucket resolved a provider by bare id under
protectedProcedure and returned the full row (OAuth tokens, app private
keys, webhook secrets) with no organization or entitlement check, letting
any authenticated user read another org's git-provider credentials (IDOR).

Adds assertGitProviderAccess() in the git-provider service (rejects cross-org
with NOT_FOUND and non-entitled same-org with FORBIDDEN, reusing the existing
getAccessibleGitProviderIds entitlement logic) and calls it in every read
handler before returning secret-bearing data.

Closes GHSA-66r5-5m5f-57vg

2026-07-19 20:55:53 -06:00

..

api

Feat/tailwind v4 shadcn update (#4706)

2026-06-30 15:45:23 -06:00

dokploy

fix(security): enforce org-scope on git provider read endpoints

2026-07-19 20:55:53 -06:00

monitoring

fix: enhance container metrics query to support wildcard matching for container names

2026-03-08 16:16:45 -06:00

schedules

Feat/tailwind v4 shadcn update (#4706)

2026-06-30 15:45:23 -06:00