mirror of
https://github.com/makeplane/plane.git
synced 2026-09-01 19:48:42 +02:00
c31bb76efa
The create branch of _resolved_action_is_authorized() checked only whether perform_create was defined anywhere in the MRO. DRF's CreateModelMixin always defines perform_create, so the check was unconditionally true and never refused an unauthorized create fall-through — the exact vulnerability class this guard exists to close, just live on the one action the guard's own review missed. The same broken check was independently duplicated in the routed-action test's other-surface scan, so the regression suite couldn't catch it either. Both call sites now require the owner to actually be ours, mirroring the existing partial_update branch. Added the missing negative test: a viewset that overrides neither create nor perform_create must still be refused. Re-ran the full route manifest scan (app and other-surface) after the fix - no new routes appeared, confirming no live create endpoint was relying on the bug. Co-authored-by: Plane AI <noreply@plane.so>