Manish Gupta 2fc210f574 [WEB-8353] fix(security): extend guest issue visibility guard to comments + reactions ...

The attachment and activity endpoints already route restricted guests
through issue_hidden_from_guest, but this PR's own docstring names
comments as in scope too — that part was never wired up. A restricted
guest blocked from GET .../history/ on a hidden issue could still call
GET .../comments/ (list and retrieve) and read all comment content on
that same issue, and could create/destroy CommentReaction rows keyed by
comment_id with no issue-visibility check at all.

Apply the same guard to IssueCommentViewSet.list/.retrieve. For
CommentReactionViewSet.create/.destroy, which only receive comment_id
(not issue_id) from the URL, resolve the parent issue first and then
apply the identical check.

Co-authored-by: Plane AI <noreply@plane.so>

2026-08-27 10:33:41 +05:30

..

admin

chore: clean up React Doctor warnings in admin app (#9418)

2026-07-15 00:47:34 +05:30

api

[WEB-8353] fix(security): extend guest issue visibility guard to comments + reactions

2026-08-27 10:33:41 +05:30

live

fix: resolve esbuild advisory and bump turbo to 2.9.18 (#9236)

2026-06-15 13:15:40 +05:30

proxy

fix: security vulnerabilities for plane docker images (#9140)

2026-05-26 14:25:01 +05:30

space

fix(security): block bot user logins (#9368)

2026-07-08 01:51:37 +05:30

web

[GIT-248 | GIT-254] refactor: store and components consolidation to core (#9245)

2026-07-16 13:13:04 +05:30