Mirrors/plane
1
0
Fork 0
mirror of https://github.com/makeplane/plane.git synced 2026-09-02 12:09:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore(security): drop advisory identifiers from code comments

Browse Source 
Explanations kept unchanged; only the IDs are removed.

Co-authored-by: Plane AI <noreply@plane.so>
This commit is contained in:
Manish Gupta
2026-08-07 16:02:11 +05:30
parent 63d1515300
commit ded0e06685
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
apps/api/plane/app/views/workspace/member.py
View File

@@ -91,7 +91,7 @@ class WorkSpaceMemberViewSet(BaseViewSet):
# passing ``request.data`` verbatim would let a workspace admin mass-assign
# ``workspace`` (relocating a controlled member row into a victim workspace as
# an admin — full cross-tenant takeover), ``is_active``, and other columns.
# Restrict the writable payload to ``role`` only. See GHSA-f739-39g5-jj49.
# Restrict the writable payload to ``role`` only.
allowed_data = {}
if "role" in request.data:
allowed_data["role"] = request.data.get("role")

2
apps/api/plane/tests/contract/app/test_workspace_member_mass_assignment_app.py
View File

@@ -3,7 +3,7 @@
# See the LICENSE file for details.
"""
Regression tests for GHSA-f739-39g5-jj49 (WEB-8332).
Regression tests for WEB-8332.
``WorkSpaceMemberViewSet.partial_update`` is only meant to update a member's
``role``. Before the fix it passed ``request.data`` verbatim to