Manish Gupta 6c9dbb5043 [WEB-7787] fix(security): block deactivated user login and fix WorkspaceOwnerPermission (#9290) ...

GHSA-rmmf-rj2q-3rrg: save_user_data() was unconditionally setting
is_active=True on every login, silently reactivating any admin-deactivated
account. Fix: add an early guard in complete_login_or_signup() that raises
USER_ACCOUNT_DEACTIVATED (5019) before any session or save logic if the
existing user's is_active=False. Remove the is_active=True assignment and
the associated user_activation_email call from save_user_data(). Also
remove the now-unused user_activation_email and base_host imports.

GHSA-wjgv-cq7w-258v: WorkspaceOwnerPermission in both app/permissions/
and utils/permissions/ was filtering WorkspaceMember without is_active=True,
allowing a deactivated workspace owner/admin to retain API access. Add
is_active=True to both copies to match every other permission class.

Co-authored-by: Plane AI <noreply@plane.so>

2026-06-23 18:10:40 +05:30

..

bin

…

plane

[WEB-7787] fix(security): block deactivated user login and fix WorkspaceOwnerPermission (#9290)

2026-06-23 18:10:40 +05:30

requirements

…

templates

…

tests

…

.coveragerc

…

.env.example

…

.prettierignore

…

Dockerfile.api

…

Dockerfile.dev

…

manage.py

…

package.json

…

pyproject.toml

…

pytest.ini

…

requirements.txt

…

run_tests.py

…

run_tests.sh

…