diff --git a/apps/api/plane/app/views/workspace/member.py b/apps/api/plane/app/views/workspace/member.py index b0e1b999b5..0ab28b14d3 100644 --- a/apps/api/plane/app/views/workspace/member.py +++ b/apps/api/plane/app/views/workspace/member.py @@ -91,7 +91,7 @@ class WorkSpaceMemberViewSet(BaseViewSet): # passing ``request.data`` verbatim would let a workspace admin mass-assign # ``workspace`` (relocating a controlled member row into a victim workspace as # an admin — full cross-tenant takeover), ``is_active``, and other columns. - # Restrict the writable payload to ``role`` only. See GHSA-f739-39g5-jj49. + # Restrict the writable payload to ``role`` only. allowed_data = {} if "role" in request.data: allowed_data["role"] = request.data.get("role") diff --git a/apps/api/plane/tests/contract/app/test_workspace_member_mass_assignment_app.py b/apps/api/plane/tests/contract/app/test_workspace_member_mass_assignment_app.py index 2301a7e6f3..65441084ac 100644 --- a/apps/api/plane/tests/contract/app/test_workspace_member_mass_assignment_app.py +++ b/apps/api/plane/tests/contract/app/test_workspace_member_mass_assignment_app.py @@ -3,7 +3,7 @@ # See the LICENSE file for details. """ -Regression tests for GHSA-f739-39g5-jj49 (WEB-8332). +Regression tests for WEB-8332. ``WorkSpaceMemberViewSet.partial_update`` is only meant to update a member's ``role``. Before the fix it passed ``request.data`` verbatim to