Mirrors/plane
1
0
Fork 0
mirror of https://github.com/makeplane/plane.git synced 2026-09-01 19:48:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore(security): drop advisory identifiers from code comments

Browse Source 
Explanations kept unchanged; only the IDs are removed.

Co-authored-by: Plane AI <noreply@plane.so>
This commit is contained in:
Manish Gupta
2026-08-07 16:00:10 +05:30
parent 53ead0a2d1
commit edb0ccd5fb
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
apps/api/plane/app/views/project/member.py
View File

@@ -391,7 +391,7 @@ class ProjectMemberPreferenceEndpoint(BaseAPIView):
def patch(self, request, slug, project_id, member_id):
# Preferences are personal: a member may only read/modify their OWN
# preferences. member_id is a URL param, so reject any mismatch to prevent
# cross-member IDOR (GHSA-gx67-r6wp-3357).
# cross-member IDOR.
if str(member_id) != str(request.user.id):
return Response(
{"error": "You cannot access another member's preferences."},
@@ -410,7 +410,7 @@ class ProjectMemberPreferenceEndpoint(BaseAPIView):
@allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
def get(self, request, slug, project_id, member_id):
# Preferences are personal: a member may only read their OWN preferences.
# member_id is a URL param, so reject any mismatch (GHSA-gx67-r6wp-3357).
# member_id is a URL param, so reject any mismatch.
if str(member_id) != str(request.user.id):
return Response(
{"error": "You cannot access another member's preferences."},

2
apps/api/plane/tests/contract/app/test_member_preference_scope_app.py
View File

@@ -4,7 +4,7 @@
"""Contract tests for ProjectMemberPreferenceEndpoint ownership scoping.
Regression coverage for GHSA-gx67-r6wp-3357. The endpoint takes a ``member_id``
The endpoint takes a ``member_id``
URL parameter and loaded the ``ProjectMember`` by ``(project_id, member_id,
workspace__slug)`` with no check that ``member_id`` is the caller — so any project
member (including a Guest) could read and modify any other member's per-project