From dcda257280654b1eba64f5fd693485893281b79b Mon Sep 17 00:00:00 2001 From: Manish Gupta Date: Fri, 7 Aug 2026 15:51:17 +0530 Subject: [PATCH] chore(security): drop advisory identifiers from code comments Explanations kept unchanged; only the IDs are removed. Co-authored-by: Plane AI --- apps/api/plane/app/views/issue/activity.py | 2 +- apps/api/plane/app/views/issue/attachment.py | 12 ++++++------ .../app/test_guest_issue_subresource_scope_app.py | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/apps/api/plane/app/views/issue/activity.py b/apps/api/plane/app/views/issue/activity.py index c8b6d66840..45c8ee8df8 100644 --- a/apps/api/plane/app/views/issue/activity.py +++ b/apps/api/plane/app/views/issue/activity.py @@ -29,7 +29,7 @@ class IssueActivityEndpoint(BaseAPIView): @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST]) def get(self, request, slug, project_id, issue_id): # A restricted guest may only see the activity/comments of issues they - # created, mirroring the issue-detail visibility rule (GHSA-wq96-4xjj-j4qg). + # created, mirroring the issue-detail visibility rule. if issue_hidden_from_guest(request, slug, project_id, issue_id): return Response( {"error": "You are not allowed to view this issue"}, diff --git a/apps/api/plane/app/views/issue/attachment.py b/apps/api/plane/app/views/issue/attachment.py index 429ade4786..fe37e3b280 100644 --- a/apps/api/plane/app/views/issue/attachment.py +++ b/apps/api/plane/app/views/issue/attachment.py @@ -37,7 +37,7 @@ class IssueAttachmentEndpoint(BaseAPIView): @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST]) def post(self, request, slug, project_id, issue_id): # A restricted guest may only add attachments to issues they created, - # mirroring the issue-detail visibility rule (GHSA-wq96-4xjj-j4qg). + # mirroring the issue-detail visibility rule. if issue_hidden_from_guest(request, slug, project_id, issue_id): return Response( {"error": "You are not allowed to view this issue"}, @@ -95,7 +95,7 @@ class IssueAttachmentEndpoint(BaseAPIView): @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST]) def get(self, request, slug, project_id, issue_id): # A restricted guest may only see attachments of issues they created, - # mirroring the issue-detail visibility rule (GHSA-wq96-4xjj-j4qg). + # mirroring the issue-detail visibility rule. if issue_hidden_from_guest(request, slug, project_id, issue_id): return Response( {"error": "You are not allowed to view this issue"}, @@ -118,7 +118,7 @@ class IssueAttachmentV2Endpoint(BaseAPIView): @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST]) def post(self, request, slug, project_id, issue_id): # A restricted guest may only add attachments to issues they created, - # mirroring the issue-detail visibility rule (GHSA-wq96-4xjj-j4qg). + # mirroring the issue-detail visibility rule. if issue_hidden_from_guest(request, slug, project_id, issue_id): return Response( {"error": "You are not allowed to view this issue"}, @@ -198,7 +198,7 @@ class IssueAttachmentV2Endpoint(BaseAPIView): @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST]) def get(self, request, slug, project_id, issue_id, pk=None): # A restricted guest may only see attachments of issues they created, - # mirroring the issue-detail visibility rule (GHSA-wq96-4xjj-j4qg). + # mirroring the issue-detail visibility rule. if issue_hidden_from_guest(request, slug, project_id, issue_id): return Response( {"error": "You are not allowed to view this issue"}, @@ -238,7 +238,7 @@ class IssueAttachmentV2Endpoint(BaseAPIView): @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST]) def patch(self, request, slug, project_id, issue_id, pk): # A restricted guest may only touch attachments of issues they created, - # mirroring the issue-detail visibility rule (GHSA-wq96-4xjj-j4qg). + # mirroring the issue-detail visibility rule. if issue_hidden_from_guest(request, slug, project_id, issue_id): return Response( {"error": "You are not allowed to view this issue"}, @@ -264,7 +264,7 @@ class IssueAttachmentV2Endpoint(BaseAPIView): ) # Update the attachment — do NOT overwrite created_by; it is set at - # creation time and must not be reassigned (GHSA-5mxw-g5mw-3v3w). + # creation time and must not be reassigned. issue_attachment.is_uploaded = True # Get the storage metadata diff --git a/apps/api/plane/tests/contract/app/test_guest_issue_subresource_scope_app.py b/apps/api/plane/tests/contract/app/test_guest_issue_subresource_scope_app.py index 7d4c04fbea..f5ca59bdb2 100644 --- a/apps/api/plane/tests/contract/app/test_guest_issue_subresource_scope_app.py +++ b/apps/api/plane/tests/contract/app/test_guest_issue_subresource_scope_app.py @@ -4,7 +4,7 @@ """Contract tests for guest visibility on issue sub-resources. -Regression coverage for GHSA-wq96-4xjj-j4qg. On a project with +On a project with ``guest_view_all_features=False`` the issue-detail endpoint correctly 403s a GUEST for issues they did not create, but the issue *sub-resource* endpoints did not replicate that restriction: