Mirrors/plane
1
0
Fork 0
mirror of https://github.com/makeplane/plane.git synced 2026-07-09 20:10:06 +02:00
Code Issues Packages Projects Releases Wiki Activity

[WEB-8066] harden: scope asset project-membership check to the asset's workspace

Browse Source 
Address Copilot review: filter ProjectMember by workspace_id=asset.workspace_id
in addition to project_id, mirroring allow_permission's PROJECT branch. Prevents
a member of the same project in a different workspace from passing the check if
an asset row is ever inconsistent (asset.workspace_id != project.workspace_id).

Co-authored-by: Plane AI <noreply@plane.so>
This commit is contained in:
Manish Gupta
2026-07-08 14:03:20 +05:30
parent bf053d3367
commit 90b6416ebf
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
apps/api/plane/app/views/asset/v2.py
View File

@@ -324,8 +324,14 @@ class WorkspaceFileAssetEndpoint(BaseAPIView):
"""
if asset.project_id is None:
return None
# Scope the membership lookup to the asset's workspace as well as its
# project, mirroring allow_permission's PROJECT branch. This prevents a
# member of the same project in a different workspace from passing the
# check should an asset row ever be inconsistent (asset.workspace_id !=
# asset.project.workspace_id).
is_project_member = ProjectMember.objects.filter(
member=request.user,
workspace_id=asset.workspace_id,
project_id=asset.project_id,
is_active=True,
).exists()