From c48480572d0babcc768bb06eefc32c1b59fcb9ad Mon Sep 17 00:00:00 2001 From: Manish Gupta Date: Thu, 27 Aug 2026 10:29:43 +0530 Subject: [PATCH] fix(security): remove internal ticket ID from test module docstring The test module's docstring embedded the internal advisory ticket reference directly in source. This repo is public, and an ID tying a docstring straight to the exact authorization gap it covers hands anyone on an unpatched fork a precise map from advisory to vulnerable code path. Reworded the docstring to describe the invariant under test (PUT must enforce the same authorization as PATCH) instead. Co-authored-by: Plane AI --- apps/api/plane/tests/contract/app/test_project_put_authz.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/apps/api/plane/tests/contract/app/test_project_put_authz.py b/apps/api/plane/tests/contract/app/test_project_put_authz.py index a1da154068..b018859eec 100644 --- a/apps/api/plane/tests/contract/app/test_project_put_authz.py +++ b/apps/api/plane/tests/contract/app/test_project_put_authz.py @@ -2,7 +2,10 @@ # SPDX-License-Identifier: AGPL-3.0-only # See the LICENSE file for details. -"""Contract tests for ``ProjectViewSet`` PUT authorization (SECUR-248). +"""Contract tests for ``ProjectViewSet`` PUT authorization. + +PUT must enforce the same authorization as PATCH, not fall through to DRF's +generic handler under the bare default permission class. ``urls/project.py`` maps ``"put": "update"``, but the viewset never defined ``update`` — so PUT fell through to DRF's ``ModelViewSet.update``. The class sets