Mirrors/plane
1
0
Fork 0
mirror of https://github.com/makeplane/plane.git synced 2026-08-29 10:08:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore(security): drop advisory identifiers and shorten comments

Browse Source 
Explanations kept; only the IDs and the restated reasoning are removed.

Co-authored-by: Plane AI <noreply@plane.so>
This commit is contained in:
Manish Gupta
2026-08-07 15:59:31 +05:30
parent 00b94d36a8
commit 448367ed27
2 changed files with 6 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
apps/api/plane/space/views/asset.py
View File

@@ -150,9 +150,8 @@ class EntityAssetEndpoint(BaseAPIView):
if not deploy_board:
return Response({"error": "Project is not published"}, status=status.HTTP_404_NOT_FOUND)
# Scope to the caller's own asset: public-site users may only mutate assets
# they created (post() sets created_by=request.user). Without created_by,
# any authenticated user could touch another user's asset (GHSA-5q33-2766-fprm).
# Public-site users may only mutate assets they created; without this any
# authenticated user could touch another's.
asset = FileAsset.objects.filter(
id=pk,
workspace=deploy_board.workspace,
@@ -179,8 +178,7 @@ class EntityAssetEndpoint(BaseAPIView):
# Check if the project is published
if not deploy_board:
return Response({"error": "Project is not published"}, status=status.HTTP_404_NOT_FOUND)
# Scope to the caller's own asset (GHSA-5q33-2766-fprm) — a public-site user
# may only delete assets they created, not another user's.
# A public-site user may only delete assets they created.
asset = FileAsset.objects.filter(
id=pk,
workspace=deploy_board.workspace,
@@ -207,8 +205,7 @@ class AssetRestoreEndpoint(BaseAPIView):
if not deploy_board:
return Response({"error": "Project is not published"}, status=status.HTTP_404_NOT_FOUND)
# Scope to the caller's own asset (GHSA-5q33-2766-fprm) — a public-site user
# may only restore assets they created, not another user's.
# A public-site user may only restore assets they created.
asset = FileAsset.all_objects.filter(
id=pk,
workspace=deploy_board.workspace,
@@ -239,8 +236,7 @@ class EntityBulkAssetEndpoint(BaseAPIView):
if not asset_ids:
return Response({"error": "No asset ids provided."}, status=status.HTTP_400_BAD_REQUEST)
# Scope to the caller's own assets (GHSA-5q33-2766-fprm) — a public-site user
# may only rebind assets they created, not another user's.
# A public-site user may only rebind assets they created.
assets = FileAsset.objects.filter(
id__in=asset_ids,
workspace=deploy_board.workspace,

2
apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py
View File

@@ -4,7 +4,7 @@
"""Contract tests for public Space asset mutation ownership scoping.
Regression coverage for GHSA-5q33-2766-fprm. The public Space asset
The public Space asset
delete/restore/bulk (and patch) endpoints require only authentication and scoped
assets to the deploy board's workspace/project — but not to
``created_by=request.user``. Any authenticated public-site user who knew the