mirror of
https://github.com/makeplane/plane.git
synced 2026-09-01 19:48:42 +02:00
a7d9f1f257
WorkSpaceMemberSerializer declared fields = "__all__" with no read_only_fields, so DRF auto-generated a writable workspace FK. WorkSpaceMemberViewSet.partial_update passes raw request.data straight into the serializer with no scrubbing, so a workspace ADMIN could PATCH any other active member's row with a workspace field pointing at a foreign workspace's UUID — moving that row (with whatever role was also in the body) into the foreign workspace with no invitation, no consent from its owner, and no audit trail. Add workspace/member (plus the usual created_by/updated_by/created_at/ updated_at) to read_only_fields on WorkSpaceMemberSerializer and its siblings WorkspaceMemberMeSerializer/WorkspaceMemberAdminSerializer — same model, same footgun shape, even though the latter two are only ever instantiated read-only today. Co-authored-by: Plane AI <noreply@plane.so>