Manish Gupta 73675d7e34 [WEB-8372] fix(security): restrict StateViewSet.partial_update to project admins (GHSA-4jpp-964m-27cr) ...

Editing a workflow state is project configuration; its sibling writes (create,
destroy, mark_as_default) are all @allow_permission([ROLE.ADMIN]). partial_update
was the outlier at [ADMIN, MEMBER, GUEST], so any project Guest could rewrite any
state's name/color/group/description and set it as the project default — a
functional bypass of the admin-only mark_as_default.

Tighten partial_update to [ROLE.ADMIN]. Adds 3 contract tests (guest 403, member
403, admin 200); fail-before verified.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-24 14:36:13 +05:30

..

bin

…

plane

[WEB-8372] fix(security): restrict StateViewSet.partial_update to project admins (GHSA-4jpp-964m-27cr)

2026-07-24 14:36:13 +05:30

requirements

chore(deps): bump cryptography (#9243)

2026-06-16 17:14:42 +05:30

templates

…

tests

…

.coveragerc

…

.env.example

…

.prettierignore

…

Dockerfile.api

…

Dockerfile.dev

…

manage.py

…

package.json

…

pyproject.toml

…

pytest.ini

…

requirements.txt

…

run_tests.py

…

run_tests.sh

…