feat: container metrics breakdown (#4571) + bulk invites/org mgmt (#4481) + IDOR fix#9
Open
BSalaeddin wants to merge 3 commits into
Open
feat: container metrics breakdown (#4571) + bulk invites/org mgmt (#4481) + IDOR fix#9BSalaeddin wants to merge 3 commits into
BSalaeddin wants to merge 3 commits into
Conversation
- Add bulkInviteMembers endpoint to organization router (up to 50 at once, skips duplicates/existing members with per-email status report) - Add updateDescription endpoint storing description in org metadata field - Add moveMemberToTeam endpoint to assign members to a teamId - New BulkInvite dialog component with dynamic rows and result summary - New UpdateOrgDescription card component on the users settings page - New MoveToTeam dialog in the member actions dropdown - Wire all three into dashboard/settings/users page Closes Dokploy#1413
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports two upstream Dokploy PRs into the community fork, both verified E2E on the test instance. Do not merge to
canaryyet — up for review.Features
1. Container resource breakdown in Monitoring — upstream Dokploy#4571
Adds a per-container resource table to the Dokploy web-server monitoring page (
/dashboard/monitoring): CPU / Memory / Disk Size / Disk I/O / Network tabs, summary cards, and an expandable per-container Processes view (docker top, top 20 by CPU). Refreshes every 5s.server.getContainerResourceStats/server.getContainerProcesses, bothwithPermission("monitoring","read")-gated.containerIdis regex-validated before interpolation intodocker top(no shell injection);getAllContainerStatsuses fixed format strings.__test__/monitoring/container-resource-usage.test.ts, 4 tests) — passes.2. Bulk invitations, org description, move-member-to-team — upstream Dokploy#4481
/dashboard/settings/users.Security fix on top of Dokploy#4481 (not in upstream)
Upstream
organization.updateDescriptiontrustedinput.organizationIdfor the write whilecheckPermissiononly authorizes againstctx.session.activeOrganizationId— a cross-tenant IDOR (an org admin could overwrite any other org's metadata). Fixed by scoping the read/write to the active org and rejecting mismatched ids withFORBIDDEN. Worth reporting upstream.Notes
apps/dokploytypecheck: clean (exit 0).Verified E2E (test instance, image
:metrics-org, host 178.105.34.146)docker topprocess expansion works.invited; existing owner →Already a member / skipped; invitation persisted then cleaned up.updateDescriptionwith a bogusorganizationId→ HTTP 403 FORBIDDEN; legitimate active-org save succeeds.