Manish Gupta 9fd1d537e2 [SECUR-243] fix(security): scope issue relation list to the URL project
Addresses Copilot review on #9531. IssueRelationViewSet.list had the same unscoped
issue_id as the write handlers: it filtered relations on workspace__slug only, so a
member of project A could list the relations of an issue in project B of the same
workspace and receive that issue's name, priority, sequence_id, assignee_ids and
label_ids. Verified 200 with the foreign issue's name in the body before the fix.

Extracts the binding into a module-level issue_in_project() helper (per CodeRabbit)
now that list, create and remove_relation all need it — one place to get right, and
the next handler added to this file has an obvious thing to call.

Adds contract coverage for the list path (cross-project 404 with no name leak, plus
an in-project positive control), extends the IssueManager boundary tests to
remove_relation and list so all handlers are pinned to the same manager, and pins
that a non-UUID related_issue is a 400 rather than a 500 — Copilot flagged that as a
500 risk, but Django raises ValidationError on UUID coercion and
BaseViewSet.handle_exception already converts it. The test locks that in.

Co-authored-by: Plane AI <noreply@plane.so>
2026-08-03 16:35:56 +05:30



Plane Logo

Modern project management for all teams

WebsiteForumXDocumentation

Plane Screens

Meet Plane, an open-source project management tool to track issues, run sprints cycles, and manage product roadmaps without the chaos of managing the tool itself. 🧘‍♀️

Plane is evolving every day. Your suggestions, ideas, and reported bugs help us immensely. Do not hesitate to join in the conversation on Forum or raise a GitHub issue. We read everything and respond to most.

🚀 Installation

Getting started with Plane is simple. Choose the setup that works best for you:

  • Plane Cloud Sign up for a free account on Plane Cloud—it's the fastest way to get up and running without worrying about infrastructure.

  • Self-host Plane Prefer full control over your data and infrastructure? Install and run Plane on your own servers. Follow our detailed deployment guides to get started.

Installation methods Docs link
Docker Docker
Kubernetes Kubernetes
Managed hosting Deploy with Zenith

Instance admins can configure instance settings with God mode.

🌟 Features

  • Work Items Efficiently create and manage tasks with a robust rich text editor that supports file uploads. Enhance organization and tracking by adding sub-properties and referencing related issues.

  • Cycles Maintain your teams momentum with Cycles. Track progress effortlessly using burn-down charts and other insightful tools.

  • Modules Simplify complex projects by dividing them into smaller, manageable modules.

  • Views Customize your workflow by creating filters to display only the most relevant issues. Save and share these views with ease.

  • Pages Capture and organize ideas using Plane Pages, complete with AI capabilities and a rich text editor. Format text, insert images, add hyperlinks, or convert your notes into actionable items.

  • Analytics Access real-time insights across all your Plane data. Visualize trends, remove blockers, and keep your projects moving forward.

🛠️ Local development

See CONTRIBUTING

⚙️ Built with

React Router Django Node JS

📸 Screenshots

Plane Views

Plane Cycles and Modules

Plane Analytics

Plane Pages

📝 Documentation

Explore Plane's product documentation and developer documentation to learn about features, setup, and usage.

❤️ Community

Join the Plane community on GitHub Discussions and our Forum. We follow a Code of conduct in all our community channels.

Feel free to ask questions, report bugs, participate in discussions, share ideas, request features, or showcase your projects. Wed love to hear from you!

🛡️ Security

If you discover a security vulnerability in Plane, please report it responsibly instead of opening a public issue. We take all legitimate reports seriously and will investigate them promptly. See Security policy for more info.

To disclose any security issues, please email us at security@plane.so.

🤝 Contributing

There are many ways you can contribute to Plane:

Please read CONTRIBUTING.md for details on the process for submitting pull requests to us.

Repo activity

Plane Repo Activity

We couldn't have done this without you.

License

This project is licensed under the GNU Affero General Public License v3.0.

Description
🔥 🔥 🔥 Open Source JIRA, Linear, Monday, and Asana Alternative. Plane helps you track your issues, epics, and cycles the easiest way on the planet. plane.so
Readme 473 MiB
Languages
TypeScript 69.6%
Python 26.6%
HTML 2.4%
JavaScript 0.6%
Shell 0.5%
Other 0.3%