fix: a few inputs

app/Actions/Docker/GetContainersStatus.php

@@ -179,7 +179,7 @@ class GetContainersStatus
                                 })->first();
                                 if (! $foundTcpProxy) {
                                     StartDatabaseProxy::run($database);
-                                    // $this->server->team?->notify(new ContainerRestarted("TCP Proxy for {$database->name}", $this->server));
+                                    // $this->server->team?->notify(new ContainerRestarted("TCP Proxy for database", $this->server));
                                 }
                             }
                         } else {

app/Actions/Server/ServerCheck.php

@@ -51,7 +51,6 @@ class ServerCheck
 
                     $containerReplicates = null;
                     $this->isSentinel = true;
-
                 } else {
                     ['containers' => $this->containers, 'containerReplicates' => $containerReplicates] = $this->server->getContainers();
                     // ServerStorageCheckJob::dispatch($this->server);
@@ -148,7 +147,6 @@ class ServerCheck
                 } else {
                     $labels = Arr::undot(data_get($container, 'Config.Labels'));
                 }
-
             }
             $managed = data_get($labels, 'coolify.managed');
             if (! $managed) {
@@ -259,7 +257,7 @@ class ServerCheck
                         })->first();
                         if (! $foundTcpProxy) {
                             StartDatabaseProxy::run($database);
-                            // $this->server->team?->notify(new ContainerRestarted("TCP Proxy for {$database->name}", $this->server));
+                            // $this->server->team?->notify(new ContainerRestarted("TCP Proxy for database", $this->server));
                         }
                     }
                 }

app/Http/Controllers/Api/ApplicationsController.php

@@ -1591,16 +1591,32 @@ class ApplicationsController extends Controller
         }
         $domains = $request->domains;
         if ($request->has('domains') && $server->isProxyShouldRun()) {
-            $errors = [];
+            $uuid = $request->uuid;
             $fqdn = $request->domains;
             $fqdn = str($fqdn)->replaceEnd(',', '')->trim();
             $fqdn = str($fqdn)->replaceStart(',', '')->trim();
-            $application->fqdn = $fqdn;
+            $errors = [];
-            if (! $application->settings->is_container_label_readonly_enabled) {
+            $fqdn = str($fqdn)->trim()->explode(',')->map(function ($domain) use (&$errors) {
-                $customLabels = str(implode('|coolify|', generateLabelsApplication($application)))->replace('|coolify|', "\n");
+                $domain = trim($domain);
-                $application->custom_labels = base64_encode($customLabels);
+                if (filter_var($domain, FILTER_VALIDATE_URL) === false || !preg_match('/^https?:\/\/[a-zA-Z0-9\-\.]+\.[a-zA-Z]{2,}/', $domain)) {
+                    $errors[] = 'Invalid domain: '.$domain;
+                }
+                return $domain;
+            });
+            if (count($errors) > 0) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => $errors,
+                ], 422);
+            }
+            if (checkIfDomainIsAlreadyUsed($fqdn, $teamId, $uuid)) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => [
+                        'domains' => 'One of the domain is already used.',
+                    ],
+                ], 422);
             }
-            $request->offsetUnset('domains');
         }
 
         $dockerComposeDomainsJson = collect();
@@ -2811,3 +2827,30 @@ class ApplicationsController extends Controller
         }
     }
 }
+
+            $fqdn = str($fqdn)->replaceStart(',', '')->trim();
+            $errors = [];
+            $fqdn = str($fqdn)->trim()->explode(',')->map(function ($domain) use (&$errors) {
+                if (filter_var($domain, FILTER_VALIDATE_URL) === false) {
+                    $errors[] = 'Invalid domain: ' . $domain;
+                }
+
+                return str($domain)->trim()->lower();
+            });
+            if (count($errors) > 0) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => $errors,
+                ], 422);
+            }
+            if (checkIfDomainIsAlreadyUsed($fqdn, $teamId, $uuid)) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => [
+                        'domains' => 'One of the domain is already used.',
+                    ],
+                ], 422);
+            }
+        }
+    }
+}

app/Http/Controllers/Api/DatabasesController.php

@@ -1557,7 +1557,8 @@ class DatabasesController extends Controller
                             ]
                         )
                     ),
-                ]),
+                ]
+            ),
             new OA\Response(
                 response: 401,
                 ref: '#/components/responses/401',
@@ -1632,9 +1633,11 @@ class DatabasesController extends Controller
                             type: 'object',
                             properties: [
                                 'message' => ['type' => 'string', 'example' => 'Database starting request queued.'],
-                            ])
+                            ]
+                        )
+                    ),
+                ]
             ),
-                ]),
             new OA\Response(
                 response: 401,
                 ref: '#/components/responses/401',
@@ -1708,9 +1711,11 @@ class DatabasesController extends Controller
                             type: 'object',
                             properties: [
                                 'message' => ['type' => 'string', 'example' => 'Database stopping request queued.'],
-                            ])
+                            ]
+                        )
+                    ),
+                ]
             ),
-                ]),
             new OA\Response(
                 response: 401,
                 ref: '#/components/responses/401',
@@ -1784,9 +1789,11 @@ class DatabasesController extends Controller
                             type: 'object',
                             properties: [
                                 'message' => ['type' => 'string', 'example' => 'Database restaring request queued.'],
-                            ])
+                            ]
+                        )
+                    ),
+                ]
             ),
-                ]),
             new OA\Response(
                 response: 401,
                 ref: '#/components/responses/401',

app/Jobs/PushServerUpdateJob.php

@@ -280,7 +280,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue
             })->first();
             if (! $tcpProxyContainerFound) {
                 StartDatabaseProxy::dispatch($database);
-                $this->server->team?->notify(new ContainerRestarted("TCP Proxy for {$database->name}", $this->server));
+                $this->server->team?->notify(new ContainerRestarted("TCP Proxy for database", $this->server));
             } else {
             }
         }

app/Models/BaseModel.php

@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Model;
 use Visus\Cuid2\Cuid2;
 
@@ -18,4 +19,16 @@ abstract class BaseModel extends Model
             }
         });
     }
+    public function name(): Attribute
+    {
+        return new Attribute(
+            get: fn() => sanitize_string($this->getRawOriginal('name')),
+        );
+    }
+    public function image(): Attribute
+    {
+        return new Attribute(
+            get: fn() => sanitize_string($this->getRawOriginal('image')),
+        );
+    }
 }

app/Models/Team.php

@@ -127,6 +127,13 @@ class Team extends Model implements SendsDiscord, SendsEmail
         ];
     }
 
+    public function name(): Attribute
+    {
+        return new Attribute(
+            get: fn() => sanitize_string($this->getRawOriginal('name')),
+        );
+    }
+
     public function getRecepients($notification)
     {
         $recipients = data_get($notification, 'emails', null);

bootstrap/helpers/shared.php

@@ -90,8 +90,28 @@ function metrics_dir(): string
     return base_configuration_dir() . '/metrics';
 }
 
+function sanitize_string(string $input): string
+{
+    // Remove any HTML/PHP tags
+    $sanitized = strip_tags($input);
+
+    // Convert special characters to HTML entities
+    $sanitized = htmlspecialchars($sanitized, ENT_QUOTES | ENT_HTML5, 'UTF-8');
+
+    // Remove any control characters
+    $sanitized = preg_replace('/[\x00-\x1F\x7F]/u', '', $sanitized);
+
+    // Trim whitespace
+    $sanitized = trim($sanitized);
+
+    return $sanitized;
+}
+
 function generate_readme_file(string $name, string $updated_at): string
 {
+    $name = sanitize_string($name);
+    $updated_at = sanitize_string($updated_at);
+
     return "Resource name: $name\nLatest Deployment Date: $updated_at";
 }