mirror of
https://github.com/Dokploy/dokploy.git
synced 2026-09-13 18:46:20 +05:00
d3f522b7a6
The remote (execAsyncRemote) path built `echo ${password} | docker ${args.join(" ")}`
with the password, registryUrl and username interpolated unescaped, so a password
like `pw; whoami` ran arbitrary commands as root on the target server. Reuse
safeDockerLoginCommand (already used by create/update), which shell-escapes each
field and feeds the password via --password-stdin. The local argv+stdin path was
already safe.
|
||
|---|---|---|
| .. | ||
| api | ||
| dokploy | ||
| monitoring | ||
| schedules | ||