fix(app): keep env values unchanged when upgrading an app (#14264)

renderUpgradeEnv still wrote the .env with godotenv.Marshal, which turns
any value that parses as an integer into its canonical form. A password
such as 0123 was rewritten as 123 on upgrade, the same bug #14180 fixed
for install. Use the env package marshaller, and escape $ inside double
quotes there so values containing both $ and a quote still read back
unchanged.

agent/app/service/app_upgrade.go

@@ -25,6 +25,7 @@ import (
 	"github.com/1Panel-dev/1Panel/agent/utils/common"
 	"github.com/1Panel-dev/1Panel/agent/utils/compose"
 	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/1Panel-dev/1Panel/agent/utils/env"
 	"github.com/1Panel-dev/1Panel/agent/utils/files"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
@@ -905,7 +906,7 @@ func renderUpgradeEnv(install *model.AppInstall, original []byte) ([]byte, error
 		}
 		install.Env = string(content)
 	}
-	content, err := godotenv.Marshal(params)
+	content, err := env.MarshalWithOrder(params, nil)
 	if err != nil {
 		return nil, err
 	}

agent/app/service/app_upgrade_env_test.go

@@ -0,0 +1,35 @@
+package service
+
+import (
+	"testing"
+
+	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/utils/docker"
+	"github.com/1Panel-dev/1Panel/agent/utils/re"
+)
+
+func TestRenderUpgradeEnvKeepsValuesExactly(t *testing.T) {
+	re.Init()
+	compose := []byte("services:\n  demo:\n    image: demo:1.0\n    environment:\n      PASSWORD: ${PANEL_DB_ROOT_PASSWORD}\n")
+	for _, password := range []string{"0123", "+123456", "-01"} {
+		install := &model.AppInstall{
+			App: model.App{Key: "demo"},
+			Env: `{"PANEL_DB_ROOT_PASSWORD":"` + password + `"}`,
+		}
+		content, err := renderUpgradeEnv(install, []byte("PANEL_DB_ROOT_PASSWORD=\""+password+"\"\n"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		project, err := docker.GetComposeProject("demo", t.TempDir(), compose, content, false)
+		if err != nil {
+			t.Fatal(err)
+		}
+		got := ""
+		if value := project.Services["demo"].Environment["PASSWORD"]; value != nil {
+			got = *value
+		}
+		if got != password {
+			t.Errorf("password %q rendered as %q, which the compose project reads as %q", password, content, got)
+		}
+	}
+}

agent/utils/env/env.go

@@ -135,6 +135,7 @@ func escapeDoubleQuotedEnvValue(s string) string {
 	replacer := strings.NewReplacer(
 		`\`, `\\`,
 		`"`, `\"`,
+		`$`, `\$`,
 		"\n", `\n`,
 	)
 	return replacer.Replace(s)

agent/utils/env/env_test.go

@@ -7,7 +7,7 @@ import (
 )
 
 func TestMarshalKeepsValuesExactly(t *testing.T) {
-	values := []string{"3306", "0", "-1", "007", "+123456", "-0123", "+0", "-0", "a'b", `a"b`, `a\b`}
+	values := []string{"3306", "0", "-1", "007", "+123456", "-0123", "+0", "-0", "a'b", `a"b`, `a\b`, "$X'"}
 	for _, v := range values {
 		envMap := map[string]string{"PANEL_DB_ROOT_PASSWORD": v}
 		for name, marshal := range map[string]func(map[string]string) (string, error){