mirror of
https://github.com/makeplane/plane.git
synced 2026-08-29 10:08:51 +02:00
e63f0c3b34
* [WEB-8066] fix: scope workspace asset get/patch/delete to project membership WorkspaceFileAssetEndpoint is authorized at the WORKSPACE level, so any workspace member/guest could reach get/patch/delete for a project-bound asset (issue attachment/description, comment description, page description) of a project they are not a member of — an incomplete fix of the GHSA-qw87 asset-IDOR cluster (GHSA-h7mc-p9mm-2r4w / GHSA-cjph-cgm5-8pw8). Add project_membership_denied(): for project-bound assets (project_id set) require an active ProjectMember of the asset's project, else 403. Workspace- level entity types (WORKSPACE_LOGO, USER_AVATAR, USER_COVER) have project_id NULL and remain accessible to any workspace member. Mirrors ProjectAssetEndpoint (level=PROJECT). Guard runs before the is_uploaded check / mutation so a non-member gets a uniform 403 and cannot probe upload state. Contract regression tests cover denied get/patch/delete for a non-project member, the positive project-member path, and the workspace-level exemption; fail-before verified. Co-authored-by: Plane AI <noreply@plane.so> * [WEB-8066] harden: scope asset project-membership check to the asset's workspace Address Copilot review: filter ProjectMember by workspace_id=asset.workspace_id in addition to project_id, mirroring allow_permission's PROJECT branch. Prevents a member of the same project in a different workspace from passing the check if an asset row is ever inconsistent (asset.workspace_id != project.workspace_id). Co-authored-by: Plane AI <noreply@plane.so> * [WEB-8066] refactor: return bool from asset access helper, build Response in views Address review (Saurabhkmr98): rename project_membership_denied -> has_project_asset_access, returning a boolean (True = allowed) instead of a Response. Each of get/patch/delete now builds the 403 Response based on the returned value. Behaviour is unchanged (same 403 + message; workspace-level assets with project_id=None still allowed). Co-authored-by: Plane AI <noreply@plane.so> --------- Co-authored-by: Plane AI <noreply@plane.so>