Mauricio Siu 5ae344db58 fix(security): authenticate and authorize the GitHub App setup callback ...

The /api/providers/github/setup callback performed privileged writes (persisting
App client_secret/webhook_secret/private_key, re-pointing installations) with no
session check, deriving the write target (organizationId/userId on gh_init,
githubId on gh_setup) from the attacker-controlled state parameter. An
unauthenticated request, or a member with no gitProviders permission, could plant
or re-point a provider in any organization.

Require a valid session, gate on the gitProviders permission (same guard the tRPC
github router uses), derive the create target from the session, and verify the
gh_setup provider belongs to the caller's organization.

2026-07-20 15:32:06 -06:00

..

api

Feat/tailwind v4 shadcn update (#4706)

2026-06-30 15:45:23 -06:00

dokploy

fix(security): authenticate and authorize the GitHub App setup callback

2026-07-20 15:32:06 -06:00

monitoring

fix: enhance container metrics query to support wildcard matching for container names

2026-03-08 16:16:45 -06:00

schedules

Feat/tailwind v4 shadcn update (#4706)

2026-06-30 15:45:23 -06:00