Manish Gupta ddefe762f3 [WEB-8401] fix(security): scope public Space asset mutations to the creator (GHSA-5q33-2766-fprm) ...

The public Space asset endpoints (space/views/asset.py) require only
IsAuthenticated and scoped assets to the deploy board's workspace/project but not
to created_by=request.user. Any authenticated public-site user who knew the anchor
and an asset UUID could delete/restore another user's asset, or rebind others'
comment-description assets to a caller-controlled entity id. EntityAssetEndpoint.post
already sets created_by=request.user, establishing the intended per-user boundary.

Scope EntityAssetEndpoint.patch/delete, AssetRestoreEndpoint.post, and
EntityBulkAssetEndpoint.post to created_by=request.user (404 when the asset isn't
the caller's). Adds 4 contract tests (attacker delete/restore/rebind blocked,
owner delete allowed); fail-before verified.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-27 12:25:13 +05:30

..

bin

[WEB-5592] chore: add static files update settings for static files support (#8251)

2025-12-09 21:05:26 +05:30

plane

[WEB-8401] fix(security): scope public Space asset mutations to the creator (GHSA-5q33-2766-fprm)

2026-07-27 12:25:13 +05:30

requirements

chore(deps): bump cryptography (#9243)

2026-06-16 17:14:42 +05:30

templates

fix: update Twitter icon and links to X (#8785) (#8790)

2026-04-07 15:34:54 +05:30

tests

fix: Add docker pytest runner and fix bugs the suite surfaced (#9138)

2026-05-26 01:21:37 +05:30

.coveragerc

…

.env.example

…

.prettierignore

…

Dockerfile.api

…

Dockerfile.dev

…

manage.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

package.json

chore: bump up the package version

2026-04-20 17:20:12 +05:30

pyproject.toml

…

pytest.ini

…

requirements.txt

…

run_tests.py

chore: add copyright (#8584)

2026-01-27 13:54:22 +05:30

run_tests.sh

…