mirror of
https://github.com/makeplane/plane.git
synced 2026-09-02 03:59:00 +02:00
834ee3cc17
DeployBoardViewSet defines only list/create; the routed retrieve/partial_update/ destroy fall through to DRF's ModelViewSet defaults, which resolve the object via get_object() -> get_queryset(). The base get_queryset returns DeployBoard.objects.all() (every workspace), and ProjectMemberPermission only checks the URL slug/project_id — nothing binds the object to that scope. So any authenticated user could supply their own workspace+project in the URL and a victim board's pk (disclosed unauth via the public settings endpoint) to read, modify, or hard-delete any workspace's published board. Override get_queryset to scope to the URL workspace__slug + project so a foreign pk 404s. Adds 4 contract tests (cross-workspace retrieve/destroy/patch blocked, own board retrievable); fail-before verified. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>