mirror of
https://github.com/makeplane/plane.git
synced 2026-07-09 20:10:06 +02:00
81d9873d7f
* fix(security): scope issue ID validation to workspace/project in bulk endpoints Prevents cross-tenant IDOR by filtering incoming issue IDs through workspace+project scope before bulk_create/bulk_update in: - CycleIssueListCreateAPIEndpoint: validate new_issues against workspace+project (GHSA-22g9-9xfv-q3fr) - SubIssuesEndpoint: validate sub_issue_ids against workspace (GHSA-38vj-gf85-7q5x) - IssueRelationListCreateAPIEndpoint: validate issues against workspace (GHSA-8cvv-8jh5-g6mj) - ModuleIssueListCreateAPIEndpoint: already scoped at line 673, no change needed (GHSA-x5c5-hmvm-94v9) Co-authored-by: Plane AI <noreply@plane.so> * fix(security): extend IDOR scope validation to app-layer endpoints Same cross-tenant IDOR fix applied to the app/views/ counterparts which are used by the web frontend (api/views/ covered in previous commit): - app/views/cycle/issue.py: filter new_issues to workspace+project (GHSA-22g9-9xfv-q3fr) - app/views/module/issue.py: filter issues to workspace+project before bulk_create (GHSA-x5c5-hmvm-94v9) - app/views/issue/relation.py: filter issues to workspace before bulk_create (GHSA-8cvv-8jh5-g6mj) Co-authored-by: Plane AI <noreply@plane.so> * chore: remove advisory ID references from code comments --------- Co-authored-by: Plane AI <noreply@plane.so> Co-authored-by: sriramveeraghanta <veeraghanta.sriram@gmail.com>