Mirrors/plane
1
0
Fork 0
mirror of https://github.com/makeplane/plane.git synced 2026-09-02 03:59:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore(security): drop advisory identifiers from code comments

Browse Source 
Explanations kept unchanged; only the IDs are removed.

Co-authored-by: Plane AI <noreply@plane.so>
This commit is contained in:
Manish Gupta
2026-08-07 15:51:17 +05:30
parent 1549846f01
commit dcda257280
3 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
apps/api/plane/app/views/issue/activity.py
View File

@@ -29,7 +29,7 @@ class IssueActivityEndpoint(BaseAPIView):
@allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
def get(self, request, slug, project_id, issue_id):
# A restricted guest may only see the activity/comments of issues they
# created, mirroring the issue-detail visibility rule (GHSA-wq96-4xjj-j4qg).
# created, mirroring the issue-detail visibility rule.
if issue_hidden_from_guest(request, slug, project_id, issue_id):
return Response(
{"error": "You are not allowed to view this issue"},

12
apps/api/plane/app/views/issue/attachment.py
View File

@@ -37,7 +37,7 @@ class IssueAttachmentEndpoint(BaseAPIView):
@allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
def post(self, request, slug, project_id, issue_id):
# A restricted guest may only add attachments to issues they created,
# mirroring the issue-detail visibility rule (GHSA-wq96-4xjj-j4qg).
# mirroring the issue-detail visibility rule.
if issue_hidden_from_guest(request, slug, project_id, issue_id):
return Response(
{"error": "You are not allowed to view this issue"},
@@ -95,7 +95,7 @@ class IssueAttachmentEndpoint(BaseAPIView):
@allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
def get(self, request, slug, project_id, issue_id):
# A restricted guest may only see attachments of issues they created,
# mirroring the issue-detail visibility rule (GHSA-wq96-4xjj-j4qg).
# mirroring the issue-detail visibility rule.
if issue_hidden_from_guest(request, slug, project_id, issue_id):
return Response(
{"error": "You are not allowed to view this issue"},
@@ -118,7 +118,7 @@ class IssueAttachmentV2Endpoint(BaseAPIView):
@allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
def post(self, request, slug, project_id, issue_id):
# A restricted guest may only add attachments to issues they created,
# mirroring the issue-detail visibility rule (GHSA-wq96-4xjj-j4qg).
# mirroring the issue-detail visibility rule.
if issue_hidden_from_guest(request, slug, project_id, issue_id):
return Response(
{"error": "You are not allowed to view this issue"},
@@ -198,7 +198,7 @@ class IssueAttachmentV2Endpoint(BaseAPIView):
@allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
def get(self, request, slug, project_id, issue_id, pk=None):
# A restricted guest may only see attachments of issues they created,
# mirroring the issue-detail visibility rule (GHSA-wq96-4xjj-j4qg).
# mirroring the issue-detail visibility rule.
if issue_hidden_from_guest(request, slug, project_id, issue_id):
return Response(
{"error": "You are not allowed to view this issue"},
@@ -238,7 +238,7 @@ class IssueAttachmentV2Endpoint(BaseAPIView):
@allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
def patch(self, request, slug, project_id, issue_id, pk):
# A restricted guest may only touch attachments of issues they created,
# mirroring the issue-detail visibility rule (GHSA-wq96-4xjj-j4qg).
# mirroring the issue-detail visibility rule.
if issue_hidden_from_guest(request, slug, project_id, issue_id):
return Response(
{"error": "You are not allowed to view this issue"},
@@ -264,7 +264,7 @@ class IssueAttachmentV2Endpoint(BaseAPIView):
)
# Update the attachment — do NOT overwrite created_by; it is set at
# creation time and must not be reassigned (GHSA-5mxw-g5mw-3v3w).
# creation time and must not be reassigned.
issue_attachment.is_uploaded = True
# Get the storage metadata

2
apps/api/plane/tests/contract/app/test_guest_issue_subresource_scope_app.py
View File

@@ -4,7 +4,7 @@
"""Contract tests for guest visibility on issue sub-resources.
Regression coverage for GHSA-wq96-4xjj-j4qg. On a project with
On a project with
``guest_view_all_features=False`` the issue-detail endpoint correctly 403s a
GUEST for issues they did not create, but the issue *sub-resource* endpoints did
not replicate that restriction: