Manish Gupta 6220ba990b [WEB-7854] fix: prevent workspace invite token disclosure and invite hijack (#9297) ...

- Add WorkSpaceMemberInvitePublicSerializer that excludes token and
  invite_link; use it in WorkspaceJoinEndpoint.get() so an unauthenticated
  caller cannot retrieve the acceptance token from the GET endpoint
  (GHSA-86mg-259g-pwgg / GHSA-gf48-p6jp-cwc4).
- Require authentication and verify request.user.email matches the
  invited email before accepting a workspace invitation so an attacker
  who registers with the invited address cannot hijack the invite
  (GHSA-4vj8-p63v-8p24).

Co-authored-by: Plane AI <noreply@plane.so>

2026-06-23 17:47:16 +05:30

..

bin

[WEB-5592] chore: add static files update settings for static files support (#8251)

2025-12-09 21:05:26 +05:30

plane

[WEB-7854] fix: prevent workspace invite token disclosure and invite hijack (#9297)

2026-06-23 17:47:16 +05:30

requirements

chore(deps): bump cryptography (#9243)

2026-06-16 17:14:42 +05:30

templates

fix: update Twitter icon and links to X (#8785) (#8790)

2026-04-07 15:34:54 +05:30

tests

fix: Add docker pytest runner and fix bugs the suite surfaced (#9138)

2026-05-26 01:21:37 +05:30

.coveragerc

…

.env.example

- Add SIGNED_URL_EXPIRATION environment variable (#8136)

2025-12-03 10:52:19 +05:30

.prettierignore

fix: eslint (#8185)

2025-12-05 16:03:51 +05:30

Dockerfile.api

…

Dockerfile.dev

…

manage.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

package.json

chore: bump up the package version

2026-04-20 17:20:12 +05:30

pyproject.toml

…

pytest.ini

…

requirements.txt

…

run_tests.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

run_tests.sh

…