Mirrors/plane
1
0
Fork 0
mirror of https://github.com/makeplane/plane.git synced 2026-08-29 10:08:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore(security): drop advisory identifiers from code comments

Browse Source 
Explanations kept unchanged; only the IDs are removed.

Co-authored-by: Plane AI <noreply@plane.so>
This commit is contained in:
Manish Gupta
2026-08-07 16:00:10 +05:30
parent 000175cb57
commit 3639e026cc
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
apps/api/plane/app/views/project/base.py
View File

@@ -545,7 +545,7 @@ class DeployBoardViewSet(BaseViewSet):
# ProjectMemberPermission only checks the URL slug/project_id — nothing
# binds the object to that scope. Scope the queryset to the URL workspace
# + project so a foreign pk 404s instead of being read/modified/deleted
# cross-workspace (GHSA-h4w5-vhxc-265g).
# cross-workspace.
return DeployBoard.objects.filter(
workspace__slug=self.kwargs.get("slug"),
entity_name="project",

2
apps/api/plane/tests/contract/app/test_deploy_board_cross_workspace_scope_app.py
View File

@@ -4,7 +4,7 @@
"""Contract tests for DeployBoardViewSet object scoping.
Regression coverage for GHSA-h4w5-vhxc-265g. ``DeployBoardViewSet`` defines only
``DeployBoardViewSet`` defines only
``list``/``create``; the routed ``retrieve``/``partial_update``/``destroy`` fall
through to DRF's ``ModelViewSet`` defaults, which resolve the object via
``get_object()`` -> ``get_queryset()``. The base ``get_queryset`` returns