From edb0ccd5fb26c6a765f0eacd2184faa9308df2ac Mon Sep 17 00:00:00 2001 From: Manish Gupta Date: Fri, 7 Aug 2026 16:00:10 +0530 Subject: [PATCH] chore(security): drop advisory identifiers from code comments Explanations kept unchanged; only the IDs are removed. Co-authored-by: Plane AI --- apps/api/plane/app/views/project/member.py | 4 ++-- .../tests/contract/app/test_member_preference_scope_app.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/apps/api/plane/app/views/project/member.py b/apps/api/plane/app/views/project/member.py index 581805a3c2..41aecbf2ef 100644 --- a/apps/api/plane/app/views/project/member.py +++ b/apps/api/plane/app/views/project/member.py @@ -391,7 +391,7 @@ class ProjectMemberPreferenceEndpoint(BaseAPIView): def patch(self, request, slug, project_id, member_id): # Preferences are personal: a member may only read/modify their OWN # preferences. member_id is a URL param, so reject any mismatch to prevent - # cross-member IDOR (GHSA-gx67-r6wp-3357). + # cross-member IDOR. if str(member_id) != str(request.user.id): return Response( {"error": "You cannot access another member's preferences."}, @@ -410,7 +410,7 @@ class ProjectMemberPreferenceEndpoint(BaseAPIView): @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST]) def get(self, request, slug, project_id, member_id): # Preferences are personal: a member may only read their OWN preferences. - # member_id is a URL param, so reject any mismatch (GHSA-gx67-r6wp-3357). + # member_id is a URL param, so reject any mismatch. if str(member_id) != str(request.user.id): return Response( {"error": "You cannot access another member's preferences."}, diff --git a/apps/api/plane/tests/contract/app/test_member_preference_scope_app.py b/apps/api/plane/tests/contract/app/test_member_preference_scope_app.py index 1163166151..e2ebd0f1a4 100644 --- a/apps/api/plane/tests/contract/app/test_member_preference_scope_app.py +++ b/apps/api/plane/tests/contract/app/test_member_preference_scope_app.py @@ -4,7 +4,7 @@ """Contract tests for ProjectMemberPreferenceEndpoint ownership scoping. -Regression coverage for GHSA-gx67-r6wp-3357. The endpoint takes a ``member_id`` +The endpoint takes a ``member_id`` URL parameter and loaded the ``ProjectMember`` by ``(project_id, member_id, workspace__slug)`` with no check that ``member_id`` is the caller — so any project member (including a Guest) could read and modify any other member's per-project