From 8882731a15971004cb84fd026d1095e2ccfdb223 Mon Sep 17 00:00:00 2001 From: Manish Gupta Date: Thu, 9 Jul 2026 15:42:32 +0530 Subject: [PATCH] [WEB-8095] fix: distinct() on page-version detail lookup as a MultipleObjectsReturned guard Address CodeRabbit review on #9380. The active-link filter already keeps the page__project_pages join to a single row via the partial-unique constraint, but add distinct() to the detail get() as defense in depth so the join can never surface MultipleObjectsReturned (a 500) even if that invariant were ever violated. Co-authored-by: Plane AI --- apps/api/plane/app/views/page/version.py | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/apps/api/plane/app/views/page/version.py b/apps/api/plane/app/views/page/version.py index 107eb26cc8..cd8a56e32a 100644 --- a/apps/api/plane/app/views/page/version.py +++ b/apps/api/plane/app/views/page/version.py @@ -23,13 +23,19 @@ class PageVersionEndpoint(BaseAPIView): # for the URL project so a page belonging to (or removed from) # another project cannot be read via this endpoint (GHSA-g49r / # GHSA-ghcr). The active-link partial-unique constraint keeps the - # join to a single row, so get() stays unambiguous. - page_version = PageVersion.objects.get( - workspace__slug=slug, - page__project_pages__project_id=project_id, - page__project_pages__deleted_at__isnull=True, - page_id=page_id, - pk=pk, + # join to a single row; distinct() is a defensive guard so the + # page__project_pages join can never make get() raise + # MultipleObjectsReturned (a 500). + page_version = ( + PageVersion.objects.filter( + workspace__slug=slug, + page__project_pages__project_id=project_id, + page__project_pages__deleted_at__isnull=True, + page_id=page_id, + pk=pk, + ) + .distinct() + .get() ) # Serialize the page version serializer = PageVersionDetailSerializer(page_version)