mirror of
https://github.com/makeplane/plane.git
synced 2026-07-10 04:25:24 +02:00
7fbf14a6cb
* [WEB-7894] fix: eliminate TOCTOU race in InstanceAdminSignUp (GHSA-p548-28jp-wr4p) Two concurrent POST requests to InstanceAdminSignUpEndpoint could both pass the "no admin yet" check before either created the InstanceAdmin row, resulting in dual instance admins. Fix: wrap the check + create in transaction.atomic() with select_for_update() on the Instance singleton row. The pre-check (is_setup_done / existing admin) outside the lock is kept as a fast early-exit for the common post-setup path. The re-check inside the lock is the authoritative guard; user_login() is kept outside the transaction to avoid holding the DB lock during session writes. Co-authored-by: Plane AI <noreply@plane.so> * fix: use global InstanceAdmin.objects.exists() guard (coderabbit) The pre-check and re-check inside the atomic block were scoped to filter(instance=instance), which could be bypassed if a stray second Instance row existed. Changed both guards to InstanceAdmin.objects.exists() to match the original global check and make them consistent with each other. Co-authored-by: Plane AI <noreply@plane.so> --------- Co-authored-by: Plane AI <noreply@plane.so>