mirror of
https://github.com/makeplane/plane.git
synced 2026-09-02 03:59:00 +02:00
f494bfd76d
Addresses review on #9596. plane/utils/permissions/project.py holds a second ProjectMemberPermission that, comments aside, was byte-identical to the one in plane/app/permissions. Its POST branch still checked workspace membership alone. It is imported (api/views/member.py) but its POST branch is currently unreachable: ProjectMemberListCreateAPIEndpoint.get_permissions() routes non-GET to ProjectAdminPermission, and the other consumer is GET-only. So this is a latent hazard rather than a second live vector — but two same-named classes that have already drifted make reintroduction easy, and this repo has previously had to patch the same duplication in the page permission classes. Both copies now carry a comment saying they must not drift. Also aligns the deploy-board 404 string with the module's existing wording ("Project does not exist", cf. base.py:230) rather than introducing a second phrasing for clients to handle. Co-authored-by: Plane AI <noreply@plane.so>