6c9dbb5043
GHSA-rmmf-rj2q-3rrg: save_user_data() was unconditionally setting is_active=True on every login, silently reactivating any admin-deactivated account. Fix: add an early guard in complete_login_or_signup() that raises USER_ACCOUNT_DEACTIVATED (5019) before any session or save logic if the existing user's is_active=False. Remove the is_active=True assignment and the associated user_activation_email call from save_user_data(). Also remove the now-unused user_activation_email and base_host imports. GHSA-wjgv-cq7w-258v: WorkspaceOwnerPermission in both app/permissions/ and utils/permissions/ was filtering WorkspaceMember without is_active=True, allowing a deactivated workspace owner/admin to retain API access. Add is_active=True to both copies to match every other permission class. Co-authored-by: Plane AI <noreply@plane.so>
110 lines
3.3 KiB
Python
110 lines
3.3 KiB
Python
# Copyright (c) 2023-present Plane Software, Inc. and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
# See the LICENSE file for details.
|
|
|
|
# Third Party imports
|
|
from rest_framework.permissions import BasePermission, SAFE_METHODS
|
|
|
|
# Module imports
|
|
from plane.db.models import WorkspaceMember
|
|
|
|
|
|
# Permission Mappings
|
|
Admin = 20
|
|
Member = 15
|
|
Guest = 5
|
|
|
|
|
|
# TODO: Move the below logic to python match - python v3.10
|
|
class WorkSpaceBasePermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
# allow anyone to create a workspace
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
if request.method == "POST":
|
|
return True
|
|
|
|
## Safe Methods
|
|
if request.method in SAFE_METHODS:
|
|
return True
|
|
|
|
# allow only admins and owners to update the workspace settings
|
|
if request.method in ["PUT", "PATCH"]:
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user,
|
|
workspace__slug=view.workspace_slug,
|
|
role__in=[Admin, Member],
|
|
is_active=True,
|
|
).exists()
|
|
|
|
# allow only owner to delete the workspace
|
|
if request.method == "DELETE":
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user,
|
|
workspace__slug=view.workspace_slug,
|
|
role=Admin,
|
|
is_active=True,
|
|
).exists()
|
|
|
|
|
|
class WorkspaceOwnerPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
return WorkspaceMember.objects.filter(
|
|
workspace__slug=view.workspace_slug, member=request.user, role=Admin, is_active=True
|
|
).exists()
|
|
|
|
|
|
class WorkSpaceAdminPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user,
|
|
workspace__slug=view.workspace_slug,
|
|
role__in=[Admin, Member],
|
|
is_active=True,
|
|
).exists()
|
|
|
|
|
|
class WorkspaceEntityPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
## Safe Methods -> Handle the filtering logic in queryset
|
|
if request.method in SAFE_METHODS:
|
|
return WorkspaceMember.objects.filter(
|
|
workspace__slug=view.workspace_slug, member=request.user, is_active=True
|
|
).exists()
|
|
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user,
|
|
workspace__slug=view.workspace_slug,
|
|
role__in=[Admin, Member],
|
|
is_active=True,
|
|
).exists()
|
|
|
|
|
|
class WorkspaceViewerPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user, workspace__slug=view.workspace_slug, is_active=True
|
|
).exists()
|
|
|
|
|
|
class WorkspaceUserPermission(BasePermission):
|
|
def has_permission(self, request, view):
|
|
if request.user.is_anonymous:
|
|
return False
|
|
|
|
return WorkspaceMember.objects.filter(
|
|
member=request.user, workspace__slug=view.workspace_slug, is_active=True
|
|
).exists()
|