Mirrors/plane
1
0
Fork 0
mirror of https://github.com/makeplane/plane.git synced 2026-09-01 19:48:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): remove internal ticket ID from test module docstring

Browse Source 
The test module's docstring embedded the internal advisory ticket
reference directly in source. This repo is public, and an ID tying a
docstring straight to the exact authorization gap it covers hands
anyone on an unpatched fork a precise map from advisory to vulnerable
code path. Reworded the docstring to describe the invariant under
test (PUT must enforce the same authorization as PATCH) instead.

Co-authored-by: Plane AI <noreply@plane.so>
This commit is contained in:
Manish Gupta
2026-08-27 10:29:43 +05:30
parent d9841a5e02
commit c48480572d
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
apps/api/plane/tests/contract/app/test_project_put_authz.py
View File

@@ -2,7 +2,10 @@
# SPDX-License-Identifier: AGPL-3.0-only
# See the LICENSE file for details.
"""Contract tests for ``ProjectViewSet`` PUT authorization (SECUR-248).
"""Contract tests for ``ProjectViewSet`` PUT authorization.
PUT must enforce the same authorization as PATCH, not fall through to DRF's
generic handler under the bare default permission class.
``urls/project.py`` maps ``"put": "update"``, but the viewset never defined
``update`` — so PUT fell through to DRF's ``ModelViewSet.update``. The class sets