mirror of
https://github.com/makeplane/plane.git
synced 2026-09-02 12:09:14 +02:00
6b0f69ba11
ProjectMemberPreferenceEndpoint.get/patch took a member_id URL param and loaded the ProjectMember by (project_id, member_id, workspace__slug) with no check that member_id is the requesting user. Any project member (including a Guest) could read and modify any other member's per-project preferences by supplying their member_id. Preferences are personal — reject any request where member_id != request.user.id with 403, on both get and patch. Adds 4 contract tests (cross-member read/write blocked, own read/write allowed); fail-before verified. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>