Manish Gupta 02f2d44abe [WEB-8382][WEB-8383] fix(security): external-API issue comment + attachment authz (GHSA-h4p4-mwfg-qh82, GHSA-xvc5-m5jf-gvpj) ...

Two authorization gaps in the external API (api/views/issue.py):

- GHSA-h4p4: IssueCommentDetailAPIEndpoint uses ProjectLitePermission (any active
  project member) and edited/deleted comments by id with no author/admin check —
  a Guest could tamper with or delete anyone's comments. patch/delete now require
  the comment author OR a project admin (403 otherwise), matching the app.

- GHSA-xvc5: IssueAttachmentListCreateAPIEndpoint.get had no permission_classes
  (bare IsAuthenticated) and no membership check, while post calls
  user_has_issue_permission. Since API tokens authenticate globally, any token
  holder could list any issue's attachment metadata cross-tenant. get now enforces
  project membership on the issue, mirroring post.

Adds 6 contract tests (guest comment patch/delete 403, author/admin allowed;
outsider attachment list 403, member allowed); fail-before verified.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-24 17:47:44 +05:30

..

analytics

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

api

[WEB-8382][WEB-8383] fix(security): external-API issue comment + attachment authz (GHSA-h4p4-mwfg-qh82, GHSA-xvc5-m5jf-gvpj)

2026-07-24 17:47:44 +05:30

app

[WEB-8074] fix: scope IssueListEndpoint to guest created_by (#9374)

2026-07-16 16:03:25 +05:30

authentication

[WEB-7778] fix(security): reject unverified OAuth provider emails to prevent ATO (Cluster E) (#9289)

2026-07-09 16:31:33 +05:30

bgtasks

fix: Use APP_DOMAIN env var for bot user email (#9262)

2026-06-21 03:03:13 +05:30

db

[GIT-175] fix: completed_at updation logic for work items (#9044)

2026-05-12 13:39:54 +05:30

license

fix(security): block bot user logins (#9368)

2026-07-08 01:51:37 +05:30

middleware

refactor: logging with retention + API token hardening (#9148)

2026-05-27 16:00:05 +05:30

seeds/data

[WEB-5602] feat: new design system (#8220)

2025-12-12 20:50:14 +05:30

settings

[WEB-7887] fix(security): prevent stored XSS via SVG attachment served inline (GHSA-ch8j-vr4r-qf6h) (#9312)

2026-07-13 20:33:46 +05:30

space

[WEB-7887] fix(security): prevent stored XSS via SVG attachment served inline (GHSA-ch8j-vr4r-qf6h) (#9312)

2026-07-13 20:33:46 +05:30

static

[WEB-6420] chore: self-host social icons in project invitation email (#8718)

2026-03-05 18:17:42 +05:30

tests

[WEB-8382][WEB-8383] fix(security): external-API issue comment + attachment authz (GHSA-h4p4-mwfg-qh82, GHSA-xvc5-m5jf-gvpj)

2026-07-24 17:47:44 +05:30

throttles

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

utils

feat(api): add lite list endpoints for projects, members, cycles, and modules (#9410)

2026-07-17 17:40:26 +05:30

web

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

__init__.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

asgi.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

celery.py

[WEB-7447] feat: migrate CE telemetry from OTLP traces to OTLP metrics (#9156)

2026-05-28 18:34:27 +05:30

urls.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

wsgi.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30