4b52dce76e
ProjectJoinEndpoint.get() was AllowAny and used ProjectMemberInviteSerializer (fields = "__all__"), leaking the invitee's email and token to anyone who knew the workspace slug, project ID, and invite UUID (GHSA-2r58-hgv7-635q). Introduce ProjectMemberInvitePublicSerializer with an explicit safe field list that excludes `email` and `token`, and swap it in for the public GET endpoint. The full serializer is retained for authenticated admin viewsets. Co-authored-by: Plane AI <noreply@plane.so>
137 lines
3.5 KiB
Python
137 lines
3.5 KiB
Python
# Copyright (c) 2023-present Plane Software, Inc. and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# See the LICENSE file for details.
|
|
|
|
from .base import BaseSerializer
|
|
from .user import (
|
|
UserSerializer,
|
|
UserLiteSerializer,
|
|
ChangePasswordSerializer,
|
|
ResetPasswordSerializer,
|
|
UserAdminLiteSerializer,
|
|
UserMeSerializer,
|
|
UserMeSettingsSerializer,
|
|
ProfileSerializer,
|
|
AccountSerializer,
|
|
)
|
|
from .workspace import (
|
|
WorkSpaceSerializer,
|
|
WorkSpaceMemberSerializer,
|
|
WorkSpaceMemberInviteSerializer,
|
|
WorkSpaceMemberInvitePublicSerializer,
|
|
WorkspaceLiteSerializer,
|
|
WorkspaceThemeSerializer,
|
|
WorkspaceMemberAdminSerializer,
|
|
WorkspaceMemberMeSerializer,
|
|
WorkspaceUserPropertiesSerializer,
|
|
WorkspaceUserLinkSerializer,
|
|
WorkspaceRecentVisitSerializer,
|
|
WorkspaceHomePreferenceSerializer,
|
|
StickySerializer,
|
|
)
|
|
from .project import (
|
|
ProjectSerializer,
|
|
ProjectListSerializer,
|
|
ProjectDetailSerializer,
|
|
ProjectMemberSerializer,
|
|
ProjectMemberInviteSerializer,
|
|
ProjectMemberInvitePublicSerializer,
|
|
ProjectIdentifierSerializer,
|
|
ProjectLiteSerializer,
|
|
ProjectMemberLiteSerializer,
|
|
DeployBoardSerializer,
|
|
ProjectMemberAdminSerializer,
|
|
ProjectPublicMemberSerializer,
|
|
ProjectMemberRoleSerializer,
|
|
ProjectMemberPreferenceSerializer,
|
|
)
|
|
from .state import StateSerializer, StateLiteSerializer
|
|
from .view import IssueViewSerializer, ViewIssueListSerializer
|
|
from .cycle import (
|
|
CycleSerializer,
|
|
CycleIssueSerializer,
|
|
CycleWriteSerializer,
|
|
CycleUserPropertiesSerializer,
|
|
)
|
|
from .asset import FileAssetSerializer
|
|
from .issue import (
|
|
IssueCreateSerializer,
|
|
IssueActivitySerializer,
|
|
IssueCommentSerializer,
|
|
ProjectUserPropertySerializer,
|
|
IssueAssigneeSerializer,
|
|
LabelSerializer,
|
|
IssueSerializer,
|
|
IssueFlatSerializer,
|
|
IssueStateSerializer,
|
|
IssueLinkSerializer,
|
|
IssueIntakeSerializer,
|
|
IssueLiteSerializer,
|
|
IssueAttachmentSerializer,
|
|
IssueSubscriberSerializer,
|
|
IssueReactionSerializer,
|
|
CommentReactionSerializer,
|
|
IssueVoteSerializer,
|
|
IssueRelationSerializer,
|
|
RelatedIssueSerializer,
|
|
IssuePublicSerializer,
|
|
IssueDetailSerializer,
|
|
IssueReactionLiteSerializer,
|
|
IssueAttachmentLiteSerializer,
|
|
IssueLinkLiteSerializer,
|
|
IssueVersionDetailSerializer,
|
|
IssueDescriptionVersionDetailSerializer,
|
|
IssueListDetailSerializer,
|
|
)
|
|
|
|
from .module import (
|
|
ModuleDetailSerializer,
|
|
ModuleWriteSerializer,
|
|
ModuleSerializer,
|
|
ModuleIssueSerializer,
|
|
ModuleLinkSerializer,
|
|
ModuleUserPropertiesSerializer,
|
|
)
|
|
|
|
from .api import APITokenSerializer, APITokenReadSerializer
|
|
|
|
from .importer import ImporterSerializer
|
|
|
|
from .page import (
|
|
PageSerializer,
|
|
PageDetailSerializer,
|
|
PageVersionSerializer,
|
|
PageBinaryUpdateSerializer,
|
|
PageVersionDetailSerializer,
|
|
)
|
|
|
|
from .estimate import (
|
|
EstimateSerializer,
|
|
EstimatePointSerializer,
|
|
EstimateReadSerializer,
|
|
WorkspaceEstimateSerializer,
|
|
)
|
|
|
|
from .intake import (
|
|
IntakeSerializer,
|
|
IntakeIssueSerializer,
|
|
IssueStateIntakeSerializer,
|
|
IntakeIssueLiteSerializer,
|
|
IntakeIssueDetailSerializer,
|
|
)
|
|
|
|
from .analytic import AnalyticViewSerializer
|
|
|
|
from .notification import NotificationSerializer, UserNotificationPreferenceSerializer
|
|
|
|
from .exporter import ExporterHistorySerializer
|
|
|
|
from .webhook import WebhookSerializer, WebhookLogSerializer
|
|
|
|
from .favorite import UserFavoriteSerializer
|
|
|
|
from .draft import (
|
|
DraftIssueCreateSerializer,
|
|
DraftIssueSerializer,
|
|
DraftIssueDetailSerializer,
|
|
)
|