Manish Gupta 5842ca8bf2 [WEB-8075] fix: scope ProjectMemberPermission SAFE_METHODS to project membership (#9375) ...

The SAFE_METHODS branch of ProjectMemberPermission filtered ProjectMember by
workspace only (no project_id), so any workspace user who was a member of *some*
project could pass the check for a project they were not in. Consumers then
returned project-scoped data:
  - v1 ProjectMemberListCreateAPIEndpoint.get -> full project roster
    (GHSA-w2vf-m9x9-mvmc)
  - app DeployBoardViewSet.list -> project publish configuration (identical
    app-copy sibling)

Add project_id=view.project_id to the SAFE_METHODS filter in both copies
(utils + app), mirroring the non-safe branch and ProjectEntityPermission. A
non-member now receives 403.

Contract regression tests cover both endpoints: a workspace user who is a
member of a different project is denied (403) on a foreign project, while an
active member of the target project is allowed. Fail-before verified (both
denied cases leak 200 without the fix).

Co-authored-by: Plane AI <noreply@plane.so>

2026-07-16 16:01:52 +05:30

..

admin

chore: clean up React Doctor warnings in admin app (#9418)

2026-07-15 00:47:34 +05:30

api

[WEB-8075] fix: scope ProjectMemberPermission SAFE_METHODS to project membership (#9375)

2026-07-16 16:01:52 +05:30

live

fix: resolve esbuild advisory and bump turbo to 2.9.18 (#9236)

2026-06-15 13:15:40 +05:30

proxy

fix: security vulnerabilities for plane docker images (#9140)

2026-05-26 14:25:01 +05:30

space

fix(security): block bot user logins (#9368)

2026-07-08 01:51:37 +05:30

web

[GIT-248 | GIT-254] refactor: store and components consolidation to core (#9245)

2026-07-16 13:13:04 +05:30