4577dc3f7a
* [WEB-7776] fix(security): scope FileAsset queries to prevent cross-project IDOR (Cluster F) Multiple asset endpoints were missing project-level scoping on FileAsset queryset filters, allowing authenticated users to access, mark-uploaded, or restore assets belonging to other projects/workspaces. - ProjectBulkAssetEndpoint.post: add project_id= scope to asset filter - EntityAssetEndpoint.get/patch: add project_id=deploy_board.project_id - AssetRestoreEndpoint.post: add project_id=deploy_board.project_id - FileAssetEndpoint (V1): add workspace membership check on get/post/delete - FileAssetViewSet.restore (V1): add workspace membership check - WorkspaceFileAssetEndpoint.post: gate WORKSPACE_LOGO on ADMIN role - DuplicateAssetEndpoint.post: restrict source asset to same workspace Fixes GHSA-r2hw, GHSA-jh4v, GHSA-8688, GHSA-3hrj and related advisories. Co-authored-by: Plane AI <noreply@plane.so> * refactor(security): replace inline membership checks with WorkspaceMemberPermission class Add WorkspaceMemberPermission to workspace.py — resolves workspace by 'workspace_id' UUID or 'slug' kwarg, covering the mixed URL patterns on FileAssetEndpoint. Apply to FileAssetEndpoint and FileAssetViewSet so membership enforcement lives in the permission layer, not inside each method handler. Co-authored-by: Plane AI <noreply@plane.so> * refactor: remove dead 404 guard in FileAssetEndpoint.post() WorkspaceMemberPermission denies requests for non-existent slugs before the view method runs, making the filter().first() + if not workspace branch unreachable. Switch to .get() so any TOCTOU race still surfaces as a 404 via ObjectDoesNotExist. Co-authored-by: Plane AI <noreply@plane.so> --------- Co-authored-by: Plane AI <noreply@plane.so>
137 lines
4.2 KiB
Python
137 lines
4.2 KiB
Python
# Copyright (c) 2023-present Plane Software, Inc. and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# See the LICENSE file for details.
|
|
|
|
# Third Party imports
|
|
from rest_framework.permissions import BasePermission, SAFE_METHODS
|
|
|
|
# Module imports
|
|
from plane.db.models import WorkspaceMember
|
|
|
|
|
|
# Permission Mappings
|
|
Admin = 20
|
|
Member = 15
|
|
Guest = 5
|
|
|
|
|
|
# TODO: Move the below logic to python match - python v3.10
|
|
class WorkSpaceBasePermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
# allow anyone to create a workspace
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
if request.method == "POST":
|
|
return True
|
|
|
|
## Safe Methods
|
|
if request.method in SAFE_METHODS:
|
|
return True
|
|
|
|
# allow only admins and owners to update the workspace settings
|
|
if request.method in ["PUT", "PATCH"]:
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user,
|
|
workspace__slug=view.workspace_slug,
|
|
role__in=[Admin, Member],
|
|
is_active=True,
|
|
).exists()
|
|
|
|
# allow only owner to delete the workspace
|
|
if request.method == "DELETE":
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user,
|
|
workspace__slug=view.workspace_slug,
|
|
role=Admin,
|
|
is_active=True,
|
|
).exists()
|
|
|
|
|
|
class WorkspaceOwnerPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
return WorkspaceMember.objects.filter(
|
|
workspace__slug=view.workspace_slug, member=request.user, role=Admin, is_active=True
|
|
).exists()
|
|
|
|
|
|
class WorkSpaceAdminPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user,
|
|
workspace__slug=view.workspace_slug,
|
|
role__in=[Admin, Member],
|
|
is_active=True,
|
|
).exists()
|
|
|
|
|
|
class WorkspaceEntityPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
## Safe Methods -> Handle the filtering logic in queryset
|
|
if request.method in SAFE_METHODS:
|
|
return WorkspaceMember.objects.filter(
|
|
workspace__slug=view.workspace_slug, member=request.user, is_active=True
|
|
).exists()
|
|
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user,
|
|
workspace__slug=view.workspace_slug,
|
|
role__in=[Admin, Member],
|
|
is_active=True,
|
|
).exists()
|
|
|
|
|
|
class WorkspaceViewerPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user, workspace__slug=view.workspace_slug, is_active=True
|
|
).exists()
|
|
|
|
|
|
class WorkspaceUserPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user, workspace__slug=view.workspace_slug, is_active=True
|
|
).exists()
|
|
|
|
|
|
class WorkspaceMemberPermission(BasePermission):
|
|
"""Allows access only to active workspace members.
|
|
|
|
Resolves the workspace via 'slug' or 'workspace_id' in URL kwargs so this
|
|
class can be used on endpoints that identify the workspace by either
|
|
identifier (e.g. FileAssetEndpoint which mixes both URL patterns).
|
|
"""
|
|
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
workspace_id = view.kwargs.get("workspace_id")
|
|
if workspace_id:
|
|
return WorkspaceMember.objects.filter(
|
|
workspace_id=workspace_id, member=request.user, is_active=True
|
|
).exists()
|
|
|
|
slug = view.kwargs.get("slug")
|
|
if slug:
|
|
return WorkspaceMember.objects.filter(
|
|
workspace__slug=slug, member=request.user, is_active=True
|
|
).exists()
|
|
|
|
return False
|