Mirrors/plane
1
0
Fork 0
mirror of https://github.com/makeplane/plane.git synced 2026-08-29 10:08:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore(security): drop advisory identifiers from code comments

Browse Source 
Explanations kept unchanged; only the IDs are removed.

Co-authored-by: Plane AI <noreply@plane.so>
This commit is contained in:
Manish Gupta
2026-08-07 16:02:26 +05:30
parent e78665ff35
commit f21ee4d42a
2 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
apps/api/plane/app/views/project/invite.py
View File

@@ -52,11 +52,10 @@ class ProjectInvitationsViewset(BaseViewSet):
.select_related("workspace", "workspace__owner")
)
# GHSA-r68c-48rr-m67f: project invitations expose invitee email + raw token
# and allow deletion, so every action must be restricted to project admins
# (mirroring create). Without these, the default list/retrieve/destroy
# inherited only IsAuthenticated, letting any workspace user read/delete
# another project's invitations.
# Project invitations expose the invitee email and the raw token, and can be
# deleted, so list/retrieve/destroy must be admin-only like create. Without
# these decorators they inherit only IsAuthenticated, letting any workspace
# user read or delete another project's invitations.
@allow_permission([ROLE.ADMIN])
def list(self, request, slug, project_id):
return super().list(request)
@@ -167,7 +166,7 @@ class UserProjectInvitationsViewset(BaseViewSet):
# Use the workspace-scoped, network-validated project IDs only.
# Raw project_ids may contain UUIDs from other workspaces; those are
# absent from the `projects` queryset and therefore bypass the SECRET
# network check above (GHSA-45hc-q4mw-jhxm).
# network check above.
validated_project_ids = [str(p.id) for p in projects]
# If the user was already part of workspace
@@ -222,8 +221,7 @@ class ProjectJoinEndpoint(BaseAPIView):
# Require an authenticated session — the accepting user must be the
# person who was invited. Without this check an attacker who knows the
# invitee email and obtains the token can hijack the project membership
# (GHSA-g36h-p63v-g9c7).
# invitee email and obtains the token can hijack the project membership.
if not request.user.is_authenticated:
return Response(
{"error": "Authentication required to accept project invitation"},

2
apps/api/plane/tests/contract/app/test_project_invite_list_scope_app.py
View File

@@ -4,7 +4,7 @@
"""Contract tests for ``ProjectInvitationsViewset`` authorization.
Regression coverage for GHSA-r68c-48rr-m67f (WEB-8291).
Regression coverage for WEB-8291.
The viewset declared no ``permission_classes`` (inheriting ``IsAuthenticated``)
and only decorated ``create`` with ``@allow_permission([ROLE.ADMIN])``. The