5b5af0aeca
* [WEB-8283] fix: bind Spaces board object IDs to the anchor's project
The public Spaces board endpoints resolved the DeployBoard from the URL
anchor but trusted the caller-supplied issue_id/comment_id/intake_id
verbatim, without verifying the object belonged to that board's
project/workspace. Any authenticated user could write comments,
reactions and votes onto arbitrary issues cross-tenant, and read EXTERNAL
comments from a different project in the same workspace.
Bind every caller-supplied object id to the board's project + workspace
before writing:
- comment / issue-reaction / vote create: require the issue to exist in
the board's project via Issue.issue_objects (excludes draft/archived/
triage), else 404.
- comment-reaction create: require the comment to exist in the board's
project with access="EXTERNAL", else 404.
- intake create: require the URL intake_id to match the board's intake,
else 400.
- comment list read: scope the queryset to the board's project_id.
Also add the missing is_votes_enabled gate on vote create for parity with
comment/reaction create (pre-existing gap in the same method).
Adds contract regression tests (fail-before verified): cross-tenant
writes and the cross-project comment read now rejected, with positive
controls confirming legitimate board writes/reads still succeed.
Co-authored-by: Plane AI <noreply@plane.so>
* [WEB-8283] test: address Copilot review — cross-workspace + votes-disabled coverage
- Add cross-workspace write test (issue in a different workspace) to
exercise the workspace_id binding, matching the advisory's cross-tenant
impact (previously only same-workspace/different-project was covered).
- Add a regression test for the new is_votes_enabled gate on vote create
(votes-disabled board → 400), preventing the pre-existing gap from
reappearing.
- Clarify the section header comment: cross-tenant writes return 404 for
issue/comment binding, 400 for the intake binding mismatch.
Co-authored-by: Plane AI <noreply@plane.so>
* [WEB-8283] refactor: extract board-scope guards into shared helpers
Address CodeRabbit review: the identical "object belongs to the board's
project+workspace" existence check was duplicated across four create()
methods (in four different ViewSets). Extract two module-level helpers —
_issue_in_board_scope and _comment_in_board_scope — so the check is a
single source of truth and cannot drift between endpoints or be forgotten
on a new one (the exact class of bug this PR fixes).
Behavior-preserving; 14 contract tests still green.
Co-authored-by: Plane AI <noreply@plane.so>
* chore(security): drop advisory identifiers from code comments
Explanations kept unchanged; only the IDs are removed.
Co-authored-by: Plane AI <noreply@plane.so>
* fix(security): use the deploy board's project_id in the reaction-create activity log
CommentReactionPublicViewSet.create() logged the activity with
str(self.kwargs.get("project_id", None)) — this route's URL only ever
supplies anchor and comment_id, never project_id, so every comment
reaction created on a public board logged project_id="None", silently
corrupting the activity/audit trail. destroy() on the same viewset
already resolves the correct project_id from the deploy board; create()
now does the same.
Co-authored-by: Plane AI <noreply@plane.so>
* [WEB-8283] fix: apply board-scope guards to comment/reaction read, update and delete paths
The board/issue/external-comment scoping added by this PR's create() methods
was never applied to the list, update and delete paths built on the same
models. A caller could read reactions on an INTERNAL (non-public) comment
through the public reaction list, or reach a comment or reaction they
authored through a board it doesn't actually belong to via partial_update()
or destroy(), since those methods looked up objects by pk/actor only.
Bind IssueCommentPublicViewSet.partial_update()/destroy() to the board's
project, workspace, issue_id and EXTERNAL access; bind
IssueReactionPublicViewSet.destroy() to the board's project (previously only
workspace-scoped); and bind CommentReactionPublicViewSet.get_queryset()/
destroy() to EXTERNAL comments only. Add regression coverage for each gap,
plus positive controls confirming legitimate reads/writes on the board's own
objects still work.
Co-authored-by: Plane AI <noreply@plane.so>
---------
Co-authored-by: Plane AI <noreply@plane.so>
294 lines
12 KiB
Python
294 lines
12 KiB
Python
# Copyright (c) 2023-present Plane Software, Inc. and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# See the LICENSE file for details.
|
|
|
|
# Python imports
|
|
import json
|
|
|
|
# Django import
|
|
from django.utils import timezone
|
|
from django.db.models import Q, OuterRef, Func, F, Prefetch
|
|
from django.core.serializers.json import DjangoJSONEncoder
|
|
|
|
# Third party imports
|
|
from rest_framework import status
|
|
from rest_framework.response import Response
|
|
|
|
# Module imports
|
|
from .base import BaseViewSet
|
|
from plane.db.models import IntakeIssue, Issue, IssueLink, FileAsset, DeployBoard, State, StateGroup
|
|
from plane.app.serializers import (
|
|
IssueSerializer,
|
|
IntakeIssueSerializer,
|
|
IssueCreateSerializer,
|
|
IssueStateIntakeSerializer,
|
|
)
|
|
from plane.utils.content_validator import validate_html_content
|
|
from plane.utils.issue_filters import issue_filters
|
|
from plane.bgtasks.issue_activities_task import issue_activity
|
|
from plane.db.models.intake import SourceType
|
|
|
|
|
|
class IntakeIssuePublicViewSet(BaseViewSet):
|
|
serializer_class = IntakeIssueSerializer
|
|
model = IntakeIssue
|
|
|
|
filterset_fields = ["status"]
|
|
|
|
def get_queryset(self):
|
|
project_deploy_board = DeployBoard.objects.get(
|
|
workspace__slug=self.kwargs.get("slug"),
|
|
project_id=self.kwargs.get("project_id"),
|
|
)
|
|
if project_deploy_board is not None:
|
|
return self.filter_queryset(
|
|
super()
|
|
.get_queryset()
|
|
.filter(
|
|
Q(snoozed_till__gte=timezone.now()) | Q(snoozed_till__isnull=True),
|
|
project_id=self.kwargs.get("project_id"),
|
|
workspace__slug=self.kwargs.get("slug"),
|
|
intake_id=self.kwargs.get("intake_id"),
|
|
)
|
|
.select_related("issue", "workspace", "project")
|
|
)
|
|
return IntakeIssue.objects.none()
|
|
|
|
def list(self, request, anchor, intake_id):
|
|
project_deploy_board = DeployBoard.objects.get(anchor=anchor, entity_name="project")
|
|
if project_deploy_board.intake is None:
|
|
return Response(
|
|
{"error": "Intake is not enabled for this Project Board"},
|
|
status=status.HTTP_400_BAD_REQUEST,
|
|
)
|
|
|
|
filters = issue_filters(request.query_params, "GET")
|
|
issues = (
|
|
Issue.objects.filter(
|
|
issue_intake__intake_id=intake_id,
|
|
workspace_id=project_deploy_board.workspace_id,
|
|
project_id=project_deploy_board.project_id,
|
|
)
|
|
.filter(**filters)
|
|
.annotate(bridge_id=F("issue_intake__id"))
|
|
.select_related("workspace", "project", "state", "parent")
|
|
.prefetch_related("assignees", "labels")
|
|
.order_by("issue_intake__snoozed_till", "issue_intake__status")
|
|
.annotate(
|
|
sub_issues_count=Issue.issue_objects.filter(parent=OuterRef("id"))
|
|
.order_by()
|
|
.annotate(count=Func(F("id"), function="Count"))
|
|
.values("count")
|
|
)
|
|
.annotate(
|
|
link_count=IssueLink.objects.filter(issue=OuterRef("id"))
|
|
.order_by()
|
|
.annotate(count=Func(F("id"), function="Count"))
|
|
.values("count")
|
|
)
|
|
.annotate(
|
|
attachment_count=FileAsset.objects.filter(
|
|
issue_id=OuterRef("id"),
|
|
entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT,
|
|
)
|
|
.order_by()
|
|
.annotate(count=Func(F("id"), function="Count"))
|
|
.values("count")
|
|
)
|
|
.prefetch_related(
|
|
Prefetch(
|
|
"issue_intake",
|
|
queryset=IntakeIssue.objects.only("status", "duplicate_to", "snoozed_till", "source"),
|
|
)
|
|
)
|
|
)
|
|
issues_data = IssueStateIntakeSerializer(issues, many=True).data
|
|
return Response(issues_data, status=status.HTTP_200_OK)
|
|
|
|
def create(self, request, anchor, intake_id):
|
|
project_deploy_board = DeployBoard.objects.get(anchor=anchor, entity_name="project")
|
|
if project_deploy_board.intake is None:
|
|
return Response(
|
|
{"error": "Intake is not enabled for this Project Board"},
|
|
status=status.HTTP_400_BAD_REQUEST,
|
|
)
|
|
|
|
# Ensure the intake belongs to this board before writing: a
|
|
# caller-supplied intake_id must be bound to the anchor.
|
|
if str(intake_id) != str(project_deploy_board.intake_id):
|
|
return Response(
|
|
{"error": "Intake does not belong to this Project Board"},
|
|
status=status.HTTP_400_BAD_REQUEST,
|
|
)
|
|
|
|
if not request.data.get("issue", {}).get("name", False):
|
|
return Response({"error": "Name is required"}, status=status.HTTP_400_BAD_REQUEST)
|
|
|
|
# Check for valid priority
|
|
if request.data.get("issue", {}).get("priority", "none") not in [
|
|
"low",
|
|
"medium",
|
|
"high",
|
|
"urgent",
|
|
"none",
|
|
]:
|
|
return Response({"error": "Invalid priority"}, status=status.HTTP_400_BAD_REQUEST)
|
|
|
|
# get the triage state
|
|
triage_state = State.triage_objects.filter(
|
|
project_id=project_deploy_board.project_id, workspace_id=project_deploy_board.workspace_id
|
|
).first()
|
|
|
|
if not triage_state:
|
|
triage_state = State.objects.create(
|
|
name="Triage",
|
|
group=StateGroup.TRIAGE.value,
|
|
project_id=project_deploy_board.project_id,
|
|
workspace_id=project_deploy_board.workspace_id,
|
|
color="#4E5355",
|
|
sequence=65000,
|
|
default=False,
|
|
)
|
|
|
|
# Sanitize description_html before saving to prevent stored XSS
|
|
raw_description_html = request.data.get("issue", {}).get("description_html", "<p></p>")
|
|
_, _, sanitized_description_html = validate_html_content(raw_description_html)
|
|
safe_description_html = sanitized_description_html if sanitized_description_html is not None else "<p></p>"
|
|
|
|
# create an issue
|
|
issue = Issue.objects.create(
|
|
name=request.data.get("issue", {}).get("name"),
|
|
description_json=request.data.get("issue", {}).get("description_json", {}),
|
|
description_html=safe_description_html,
|
|
priority=request.data.get("issue", {}).get("priority", "low"),
|
|
project_id=project_deploy_board.project_id,
|
|
state_id=triage_state.id,
|
|
)
|
|
|
|
# Create an Issue Activity
|
|
issue_activity.delay(
|
|
type="issue.activity.created",
|
|
requested_data=json.dumps(request.data, cls=DjangoJSONEncoder),
|
|
actor_id=str(request.user.id),
|
|
issue_id=str(issue.id),
|
|
project_id=str(project_deploy_board.project_id),
|
|
current_instance=None,
|
|
epoch=int(timezone.now().timestamp()),
|
|
)
|
|
# create an intake issue
|
|
IntakeIssue.objects.create(
|
|
intake_id=intake_id,
|
|
project_id=project_deploy_board.project_id,
|
|
issue=issue,
|
|
source=SourceType.IN_APP,
|
|
)
|
|
|
|
serializer = IssueStateIntakeSerializer(issue)
|
|
return Response(serializer.data, status=status.HTTP_200_OK)
|
|
|
|
def partial_update(self, request, anchor, intake_id, pk):
|
|
project_deploy_board = DeployBoard.objects.get(anchor=anchor, entity_name="project")
|
|
if project_deploy_board.intake is None:
|
|
return Response(
|
|
{"error": "Intake is not enabled for this Project Board"},
|
|
status=status.HTTP_400_BAD_REQUEST,
|
|
)
|
|
|
|
intake_issue = IntakeIssue.objects.get(
|
|
pk=pk,
|
|
workspace_id=project_deploy_board.workspace_id,
|
|
project_id=project_deploy_board.project_id,
|
|
intake_id=intake_id,
|
|
)
|
|
# Get the project member
|
|
if str(intake_issue.created_by_id) != str(request.user.id):
|
|
return Response(
|
|
{"error": "You cannot edit intake issues"},
|
|
status=status.HTTP_400_BAD_REQUEST,
|
|
)
|
|
|
|
# Get issue data
|
|
issue_data = request.data.pop("issue", False)
|
|
|
|
issue = Issue.objects.get(
|
|
pk=intake_issue.issue_id,
|
|
workspace_id=project_deploy_board.workspace_id,
|
|
project_id=project_deploy_board.project_id,
|
|
)
|
|
# viewers and guests since only viewers and guests
|
|
issue_data = {
|
|
"name": issue_data.get("name", issue.name),
|
|
"description_html": issue_data.get("description_html", issue.description_html),
|
|
"description_json": issue_data.get("description_json", issue.description_json),
|
|
}
|
|
|
|
issue_serializer = IssueCreateSerializer(
|
|
issue,
|
|
data=issue_data,
|
|
partial=True,
|
|
context={"project_id": project_deploy_board.project_id, "allow_triage_state": True},
|
|
)
|
|
|
|
if issue_serializer.is_valid():
|
|
current_instance = issue
|
|
# Log all the updates
|
|
requested_data = json.dumps(issue_data, cls=DjangoJSONEncoder)
|
|
if issue is not None:
|
|
issue_activity.delay(
|
|
type="issue.activity.updated",
|
|
requested_data=requested_data,
|
|
actor_id=str(request.user.id),
|
|
issue_id=str(issue.id),
|
|
project_id=str(project_deploy_board.project_id),
|
|
current_instance=json.dumps(IssueSerializer(current_instance).data, cls=DjangoJSONEncoder),
|
|
epoch=int(timezone.now().timestamp()),
|
|
)
|
|
issue_serializer.save()
|
|
return Response(issue_serializer.data, status=status.HTTP_200_OK)
|
|
return Response(issue_serializer.errors, status=status.HTTP_400_BAD_REQUEST)
|
|
|
|
def retrieve(self, request, anchor, intake_id, pk):
|
|
project_deploy_board = DeployBoard.objects.get(anchor=anchor, entity_name="project")
|
|
if project_deploy_board.intake is None:
|
|
return Response(
|
|
{"error": "Intake is not enabled for this Project Board"},
|
|
status=status.HTTP_400_BAD_REQUEST,
|
|
)
|
|
|
|
intake_issue = IntakeIssue.objects.get(
|
|
pk=pk,
|
|
workspace_id=project_deploy_board.workspace_id,
|
|
project_id=project_deploy_board.project_id,
|
|
intake_id=intake_id,
|
|
)
|
|
issue = Issue.objects.get(
|
|
pk=intake_issue.issue_id,
|
|
workspace_id=project_deploy_board.workspace_id,
|
|
project_id=project_deploy_board.project_id,
|
|
)
|
|
serializer = IssueStateIntakeSerializer(issue)
|
|
return Response(serializer.data, status=status.HTTP_200_OK)
|
|
|
|
def destroy(self, request, anchor, intake_id, pk):
|
|
project_deploy_board = DeployBoard.objects.get(anchor=anchor, entity_name="project")
|
|
if project_deploy_board.intake is None:
|
|
return Response(
|
|
{"error": "Intake is not enabled for this Project Board"},
|
|
status=status.HTTP_400_BAD_REQUEST,
|
|
)
|
|
|
|
intake_issue = IntakeIssue.objects.get(
|
|
pk=pk,
|
|
workspace_id=project_deploy_board.workspace_id,
|
|
project_id=project_deploy_board.project_id,
|
|
intake_id=intake_id,
|
|
)
|
|
|
|
if str(intake_issue.created_by_id) != str(request.user.id):
|
|
return Response(
|
|
{"error": "You cannot delete intake issue"},
|
|
status=status.HTTP_400_BAD_REQUEST,
|
|
)
|
|
|
|
intake_issue.delete()
|
|
return Response(status=status.HTTP_204_NO_CONTENT)
|