mirror of
https://github.com/makeplane/plane.git
synced 2026-09-02 03:59:00 +02:00
fbb96fc66a
The unauthenticated GET /api/workspaces/<slug>/invitations/<pk>/join/ endpoint serialized the invitation with `fields = "__all__"`, exposing the secret invitation `token` (and an `invite_link` containing it) to any caller who could guess a workspace slug + invitation id. Reject GET requests that don't supply the matching `?token=` from the emailed invite link, comparing in constant time, and additionally strip `token` and `invite_link` from the response as defense in depth. Frontend callers (`/workspace-invitations` page, auth header) now thread the token from the URL through `getWorkspaceInvitation`. Auth pages visited without an invite token simply skip the invitation banner SWR call — they have no proof of access and shouldn't see invitation data.