From 4b7a6295fc88decc3d032d1bb058bdd4f77cb2a2 Mon Sep 17 00:00:00 2001 From: Mauricio Siu Date: Fri, 28 Aug 2026 16:49:06 -0600 Subject: [PATCH] fix: verify server ownership before running IP detection validateDomain accepted an arbitrary serverId and used it to look up the server and SSH into it, without checking it belonged to the caller's active organization. A member with domain:read could probe other orgs' servers and get their SSH/detected IPs back in the response. Addresses greptile review on #5214 --- apps/dokploy/server/api/routers/domain.ts | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/apps/dokploy/server/api/routers/domain.ts b/apps/dokploy/server/api/routers/domain.ts index 4917b966e..10c0b8a8c 100644 --- a/apps/dokploy/server/api/routers/domain.ts +++ b/apps/dokploy/server/api/routers/domain.ts @@ -252,7 +252,17 @@ export const domainRouter = createTRPCRouter({ serverId: z.string().optional(), }), ) - .mutation(async ({ input }) => { + .mutation(async ({ input, ctx }) => { + if (input.serverId) { + const server = await findServerById(input.serverId); + if (server.organizationId !== ctx.session.activeOrganizationId) { + throw new TRPCError({ + code: "UNAUTHORIZED", + message: "You are not authorized to access this server", + }); + } + } + const expectedIps = await getServerIpCandidates(input.serverId); return validateDomain(input.domain, expectedIps); }),