Mauricio Siu 68f5afae42 fix(security): authorize docker/terminal WebSocket handlers ...

The /terminal, /docker-container-terminal, /docker-container-logs and
/docker-stats WebSocket handlers only checked session + organization, so any
authenticated member could open a root shell / read logs of any container, and
the local (serverId=local) branch reached a root SSH shell on the control-plane
host.

Adds an authorization layer (server/wss/authorize.ts):
- container ops (terminal/logs/stats): require the docker permission (owner/admin
  or a member granted canAccessToDocker); for a remote server, require the server
  be accessible to the caller.
- host/server terminal: the local host root terminal is restricted to owner/admin;
  a remote server terminal is gated on server access.

Closes GHSA-c68r-7wg9-p7v2, GHSA-899j-cjwp-v4gw, GHSA-7r6p-v9gw-pwc8, GHSA-qf9j-c9p4-r4xp

2026-07-19 23:49:02 -06:00

..

api

fix: validate API key name length to prevent opaque 500

2026-07-12 18:15:05 +05:30

backups

fix(security): pass db backup/restore identifiers via env vars to avoid injection

2026-07-19 22:54:44 -06:00

cluster

fix(security): escape swarm nodeId and registry tag in cluster commands

2026-07-19 23:34:18 -06:00

compose

[autofix.ci] apply automated fixes

2026-07-20 05:07:24 +00:00

deploy

fix(security): escape dockerImage in database service remote docker pull

2026-07-19 22:45:31 -06:00

drop

Merge branch 'canary' into feat/application-icon-upload

2026-04-04 18:29:52 -06:00

env

feat: export full keyring in backup encryption key file

2026-07-10 03:16:31 -06:00

git-provider

Merge pull request #4856 from Dokploy/fix/idor-git-provider-secret-disclosure

2026-07-19 21:11:08 -06:00

permissions

fix: allow members with git providers permission to create and delete their own (#4713)

2026-06-30 15:57:50 -06:00

queues

feat: make concurrent builds an OSS feature without license gating

2026-07-09 02:24:08 -06:00

registry

fix(registry): preserve username case for ECR compatibility (#4632) (#4647)

2026-06-30 16:07:15 -06:00

requests

[autofix.ci] apply automated fixes

2025-12-10 05:16:25 +00:00

server

Merge pull request #4858 from Dokploy/fix/idor-swarm-cross-org

2026-07-19 21:28:53 -06:00

templates

[autofix.ci] apply automated fixes

2026-05-09 01:32:34 +00:00

traefik

Feat/concurrent deployments in memory queue (#4645)

2026-06-16 23:15:19 -06:00

utils

fix(domain): validate hostname format to reject invalid characters (#4729)

2026-07-05 14:53:01 -06:00

wss

fix(security): authorize docker/terminal WebSocket handlers

2026-07-19 23:49:02 -06:00

setup.ts

test: add mock implementation for member.findMany in application command and real tests

2026-02-28 22:59:24 -06:00

vitest.config.ts

chore(deps): update @types/node version across multiple packages

2026-02-05 02:05:07 -06:00