mirror of
https://github.com/makeplane/plane.git
synced 2026-09-02 03:59:00 +02:00
14a4c22f94
* fix(security): enforce token + auth validation on project invite accept/reject ProjectJoinEndpoint.post() only checked that the caller-supplied email matched the invited email — no token required, no authentication required. Anyone who knew the workspace slug, project ID, invite UUID, and invitee email could accept or reject the invitation on the invitee's behalf (GHSA-g36h-p63v-g9c7). Mirror WorkspaceJoinEndpoint.post() exactly: - Validate `token` from request body against project_invite.token (→ 403 on mismatch) - Require authenticated session (→ 401 if unauthenticated) - Validate request.user.email against project_invite.email (→ 403 on mismatch) - Remove the old request.data["email"] guard - Use project_invite.email for downstream User lookup Co-authored-by: Plane AI <noreply@plane.so> * fix(security): address CR review on project invite token validation - Use request.user directly instead of re-querying User by exact project_invite.email — avoids case-variant miss after the case-insensitive email check already validated the authenticated user (CR comment 1) - Validate `accepted` as a real boolean before saving — form-encoded strings like "false" are truthy and could accidentally create memberships (CR comment 2) Co-authored-by: Plane AI <noreply@plane.so> --------- Co-authored-by: Plane AI <noreply@plane.so>