Mirrors/plane
1
0
Fork 0
mirror of https://github.com/makeplane/plane.git synced 2026-07-09 20:10:06 +02:00
Code Issues Packages Projects Releases Wiki Activity

[WEB-7730] fix(security): scope cascade deletes to workspace in BulkDeleteIssuesEndpoint (#9270)

Browse Source 
* fix(security): scope cascade deletes to workspace in BulkDeleteIssuesEndpoint

CycleIssue and ModuleIssue cascade deletes used raw issue_ids from the
request instead of the already workspace+project scoped issues queryset,
allowing cross-workspace deletion of related records.

Fixes GHSA-6cw7-h92q-p9hg and GHSA-2rr4-rp7r-32p4.
GHSA-7q7r-mrr4-2wwx (sub-issue parent reassign) covered in WEB-7727.

Co-authored-by: Plane AI <noreply@plane.so>

* chore: remove advisory ID reference from code comment

---------

Co-authored-by: Plane AI <noreply@plane.so>
Co-authored-by: sriramveeraghanta <veeraghanta.sriram@gmail.com>
This commit is contained in:
Manish Gupta
2026-06-20 16:41:21 +05:30
committed by GitHub
parent 53a323d559
commit ad73ca300c
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
apps/api/plane/app/views/issue/base.py
View File

@@ -771,10 +771,10 @@ class BulkDeleteIssuesEndpoint(BaseAPIView):
total_issues = len(issues)
# First, delete all related cycle issues
CycleIssue.objects.filter(issue_id__in=issue_ids).delete()
CycleIssue.objects.filter(issue__in=issues).delete()
# Then, delete all related module issues
ModuleIssue.objects.filter(issue_id__in=issue_ids).delete()
ModuleIssue.objects.filter(issue__in=issues).delete()
# Finally, delete the issues themselves
issues.delete()