Manish Gupta 2844c1d695 [WEB-8074] fix: scope IssueListEndpoint to guest created_by ...

IssueListEndpoint.get (/workspaces/<slug>/projects/<project_id>/issues/list/)
returned any issue whose id was passed in ?issues=, without the guest
created_by restriction its sibling IssueViewSet.list enforces. A project GUEST
(role=5) on a project with guest_view_all_features=False could read issues they
did not author by supplying their ids (GHSA-32c7-84jc-4w67).

Replicate the guest scope: when the requester is an active role=5 ProjectMember
and not project.guest_view_all_features, filter the queryset to
created_by=request.user. Applied to the base queryset so it flows through
filtering, annotation and grouping.

Contract regression tests cover the restricted guest (own-only), a full member
(sees all), and a guest with guest_view_all_features enabled (sees all);
fail-before verified.

Co-authored-by: Plane AI <noreply@plane.so>

2026-07-08 16:31:58 +05:30

..

bin

…

plane

[WEB-8074] fix: scope IssueListEndpoint to guest created_by

2026-07-08 16:31:58 +05:30

requirements

…

templates

…

tests

…

.coveragerc

…

.env.example

…

.prettierignore

…

Dockerfile.api

…

Dockerfile.dev

…

manage.py

…

package.json

…

pyproject.toml

…

pytest.ini

…

requirements.txt

…

run_tests.py

…

run_tests.sh

…