mirror of
https://github.com/makeplane/plane.git
synced 2026-09-01 19:48:42 +02:00
d02e0c3187
get_entity_id_field() derives the persisted project_id for a PROJECT_COVER duplicate from entity_id, overriding whatever project_id was supplied in the request body -- so entity_id, not project_id, is the value that actually lands on the new row. The membership check only ever validated project_id, so a caller could name a project they belong to there just to pass that check, while entity_id (the real destination) pointed at a project they were never checked against. Composes with the prior project_id=None default fix: for PROJECT_COVER we now set project_id = entity_id before that block runs, so the same existence/membership checks and the default-to-source-project fallback apply to the value that's actually persisted. Also stops get_entity_id_field's project_id colliding with the explicit project_id kwarg passed to FileAsset.objects.create(). Co-authored-by: Plane AI <noreply@plane.so>