af1be50b48
* [WEB-8074] fix: scope IssueListEndpoint to guest created_by IssueListEndpoint.get (/workspaces/<slug>/projects/<project_id>/issues/list/) returned any issue whose id was passed in ?issues=, without the guest created_by restriction its sibling IssueViewSet.list enforces. A project GUEST (role=5) on a project with guest_view_all_features=False could read issues they did not author by supplying their ids (GHSA-32c7-84jc-4w67). Replicate the guest scope: when the requester is an active role=5 ProjectMember and not project.guest_view_all_features, filter the queryset to created_by=request.user. Applied to the base queryset so it flows through filtering, annotation and grouping. Contract regression tests cover the restricted guest (own-only), a full member (sees all), and a guest with guest_view_all_features enabled (sees all); fail-before verified. Co-authored-by: Plane AI <noreply@plane.so> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Plane AI <noreply@plane.so> Co-authored-by: Dheeraj Kumar Ketireddy <dheeraj.ketireddy@plane.so> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| activity.py | ||
| archive.py | ||
| attachment.py | ||
| base.py | ||
| comment.py | ||
| label.py | ||
| link.py | ||
| reaction.py | ||
| relation.py | ||
| sub_issue.py | ||
| subscriber.py | ||
| version.py | ||