andwati/dokploy
1
0
Fork 0
mirror of https://github.com/andwati/dokploy.git synced 2026-11-09 13:35:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4874 from Dokploy/fix/idor-server-remove

Browse Source 
fix(security): cross-org authorization bypass in server.remove
This commit is contained in:
Mauricio Siu
2026-07-20 17:40:18 -06:00
committed by GitHub
parent ffe62bca0e 4aee66b2d1
commit b2ade17487
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/dokploy/server/api/routers/server.ts
+8 -1
View File
@@ -413,6 +413,14 @@ export const serverRouter = createTRPCRouter({
.input(apiRemoveServer) .input(apiRemoveServer)
.mutation(async ({ input, ctx }) => { .mutation(async ({ input, ctx }) => {
try { try {
const currentServer = await findServerById(input.serverId);
if (currentServer.organizationId !== ctx.session.activeOrganizationId) {
throw new TRPCError({
code: "UNAUTHORIZED",
message: "You are not authorized to delete this server",
});
}
const activeServers = await haveActiveServices(input.serverId); const activeServers = await haveActiveServices(input.serverId);
if (activeServers) { if (activeServers) {
@@ -421,7 +429,6 @@ export const serverRouter = createTRPCRouter({
message: "Server has active services, please delete them first", message: "Server has active services, please delete them first",
}); });
} }
const currentServer = await findServerById(input.serverId);
await audit(ctx, { await audit(ctx, {
action: "delete", action: "delete",
resourceType: "server", resourceType: "server",