mirror of
https://github.com/Dokploy/dokploy.git
synced 2026-07-23 06:45:27 +02:00
5ae344db58
The /api/providers/github/setup callback performed privileged writes (persisting App client_secret/webhook_secret/private_key, re-pointing installations) with no session check, deriving the write target (organizationId/userId on gh_init, githubId on gh_setup) from the attacker-controlled state parameter. An unauthenticated request, or a member with no gitProviders permission, could plant or re-point a provider in any organization. Require a valid session, gate on the gitProviders permission (same guard the tRPC github router uses), derive the create target from the session, and verify the gh_setup provider belongs to the caller's organization.
Join us on Discord for help, feedback, and discussions!
Dokploy is a free, self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases.
✨ Features
Dokploy includes multiple features to make your life easier.
- Applications: Deploy any type of application (Node.js, PHP, Python, Go, Ruby, etc.).
- Databases: Create and manage databases with support for MySQL, PostgreSQL, MongoDB, MariaDB, libsql, and Redis.
- Backups: Automate backups for databases to an external storage destination.
- Docker Compose: Native support for Docker Compose to manage complex applications.
- Multi Node: Scale applications to multiple nodes using Docker Swarm to manage the cluster.
- Templates: Deploy open-source templates (Plausible, Pocketbase, Calcom, etc.) with a single click.
- Traefik Integration: Automatically integrates with Traefik for routing and load balancing.
- Real-time Monitoring: Monitor CPU, memory, storage, and network usage for every resource.
- Docker Management: Easily deploy and manage Docker containers.
- CLI/API: Manage your applications and databases using the command line or through the API.
- Notifications: Get notified when your deployments succeed or fail (via Slack, Discord, Telegram, Email, etc.).
- Multi Server: Deploy and manage your applications remotely to external servers.
- Self-Hosted: Self-host Dokploy on your VPS.
🚀 Getting Started
To get started, run the following command on a VPS:
Want to skip the installation process? Try the Dokploy Cloud.
curl -sSL https://dokploy.com/install.sh | bash
For detailed documentation, visit docs.dokploy.com.
Contributors 🤝
📺 Video Tutorial
🤝 Contributing
Check out the Contributing Guide for more information.