mirror of
https://github.com/makeplane/plane.git
synced 2026-09-01 19:48:42 +02:00
6da62c6bb6
The list() project-scope guard added for the cross-project relation-list IDOR used Issue.issue_objects to look up the parent issue, but that manager excludes archived issues — so viewing relations on an archived issue started 404ing even for members of its own project. The issue detail page fetches relations unconditionally on load, including for archived issues, and renders the panel read-only rather than hiding it there, so this closed off a legitimate read path along with the hole. Give issue_in_project() an include_archived flag and use it only in list(), following the same Issue.objects (archive-inclusive) pattern IssueViewSet.retrieve() already uses for reads. The write paths (create/remove_relation) keep the narrower issue_objects manager unchanged, and the project/workspace scoping check itself is untouched in all three, so the original cross-project fix still holds. Co-authored-by: Plane AI <noreply@plane.so>