plane

mirror of https://github.com/makeplane/plane.git synced 2026-09-02 03:59:00 +02:00

Files

Manish Gupta 02f2d44abe [WEB-8382][WEB-8383] fix(security): external-API issue comment + attachment authz (GHSA-h4p4-mwfg-qh82, GHSA-xvc5-m5jf-gvpj)

Two authorization gaps in the external API (api/views/issue.py):

- GHSA-h4p4: IssueCommentDetailAPIEndpoint uses ProjectLitePermission (any active
  project member) and edited/deleted comments by id with no author/admin check —
  a Guest could tamper with or delete anyone's comments. patch/delete now require
  the comment author OR a project admin (403 otherwise), matching the app.

- GHSA-xvc5: IssueAttachmentListCreateAPIEndpoint.get had no permission_classes
  (bare IsAuthenticated) and no membership check, while post calls
  user_has_issue_permission. Since API tokens authenticate globally, any token
  holder could list any issue's attachment metadata cross-tenant. get now enforces
  project membership on the issue, mirroring post.

Adds 6 contract tests (guest comment patch/delete 403, author/admin allowed;
outsider attachment list 403, member allowed); fail-before verified.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-24 17:47:44 +05:30