ProjectJoinEndpoint.get() was AllowAny and used ProjectMemberInviteSerializer
(fields = "__all__"), leaking the invitee's email and token to anyone who
knew the workspace slug, project ID, and invite UUID (GHSA-2r58-hgv7-635q).
Introduce ProjectMemberInvitePublicSerializer with an explicit safe field list
that excludes `email` and `token`, and swap it in for the public GET endpoint.
The full serializer is retained for authenticated admin viewsets.
Co-authored-by: Plane AI <noreply@plane.so>
- Add WorkSpaceMemberInvitePublicSerializer that excludes token and
invite_link; use it in WorkspaceJoinEndpoint.get() so an unauthenticated
caller cannot retrieve the acceptance token from the GET endpoint
(GHSA-86mg-259g-pwgg / GHSA-gf48-p6jp-cwc4).
- Require authentication and verify request.user.email matches the
invited email before accepting a workspace invitation so an attacker
who registers with the invited address cannot hijack the invite
(GHSA-4vj8-p63v-8p24).
Co-authored-by: Plane AI <noreply@plane.so>
* refactor: rename IssueUserProperty to ProjectUserProperty and update related references across the codebase
* migrate: move issue user properties to project user properties and update related fields and constraints
* refactor: rename IssueUserPropertySerializer and IssueUserDisplayPropertyEndpoint to ProjectUserPropertySerializer and ProjectUserDisplayPropertyEndpoint, updating all related references
* fix: enhance ProjectUserDisplayPropertyEndpoint to handle missing properties by creating new entries and improve response handling
* fix: correct formatting in migration for ProjectUserProperty model options
* migrate: add migration to update existing non-service API tokens to remove workspace association
* migrate: refine migration to update existing non-service API tokens by excluding bot users from workspace removal
* chore: changed the project sort order in project user property
* chore: remove allowed_rate_limit from APIToken
* chore: updated user-properties endpoint for frontend
* chore: removed the extra projectuserproperty
* chore: updated the migration file
* chore: code refactor
* fix: type error
---------
Co-authored-by: NarayanBavisetti <narayan3119@gmail.com>
Co-authored-by: sangeethailango <sangeethailango21@gmail.com>
Co-authored-by: vamsikrishnamathala <matalav55@gmail.com>
Co-authored-by: Anmol Singh Bhatia <anmolsinghbhatia@plane.so>
* chore: update navigation_project_limit and navigation_control_preference
* chore: set default true for user specific widgets
* chore: use serializer in ProjectMemberPreferenceEndpoint
chore: use serializer in WorkspaceUserPropertiesEndpoint
"
* fix: validate preferences
* fix: status code
* fix: remove saving from validate
* fix: simply validate_preferences
* chore: create WorkspaceUserProperties if it doesn't exist
* fix: create WorksapceUserProperties it not exist
* fix: copy the instance
* Revert "fix: copy the instance"
This reverts commit ddb0384b6dfa0dc52929972c4e2cd7ce85c69667.
* chore: migrate WorkspaceUserPreference to set defaults
* fix: migration file name
* Revert "fix: migration file name"
This reverts commit 80a21dedf1a1245f22e45bfeaf20e8e9f91a1cbf.
* Revert "chore: migrate WorkspaceUserPreference to set defaults"
This reverts commit 25bc583a081ce79d52ec721f69cf8e61de3e8fb3.
* added PageBinaryUpdateSerializer for binary data validation and update
* chore: added validation for description
* chore: removed the duplicated file
* Fixed coderabbit comments
- Improve content validation by consolidating patterns and enhancing recursion checks
- Updated `PageBinaryUpdateSerializer` to simplify assignment of validated data.
- Enhanced `content_validator.py` with consolidated dangerous patterns and added recursion depth checks to prevent stack overflow during validation.
- Improved readability and maintainability of validation functions by using constants for patterns.
---------
Co-authored-by: Dheeraj Kumar Ketireddy <dheeru0198@gmail.com>
