Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[bug]: Workspace drafts: members get 403 on their own draft; admins can delete other users’ drafts

Abierto
  • ¿Algo no está bien?
#10,001 1 comentario 0 reacciones 2 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@vihar ya está trabajando en esto.

Desde el 13/10/2026.

  • #10006 de @Vishesh-Verma-07 — abierto

Evaluación

Este issue todavía no se ha evaluado.

Descripción

🐛bug plane
Is there an existing issue for this?
  • I have searched the existing issues
Current behavior

Workspace drafts are meant to be private to their creator. list, partial_update and create_draft_to_issue in WorkspaceDraftIssueViewSet all scope the lookup to created_by=request.user, but two sibling actions don't:

  1. Members get 403 on their own draft.retrieve is decorated with allowed_roles=[ROLE.ADMIN], creator=True, model=Issue. A draft id never exists in the Issue table, so the creator check never matches, and a workspace MEMBER gets {"error": "You don't have the required permissions."} when opening a draft they created.

  2. Admins can delete other users' private drafts. destroy fetches the draft with DraftIssue.objects.get(workspace__slug=slug, pk=pk), with no owner check. A workspace ADMIN can delete another member's draft, even though they can't list or open it.

Expected: any ADMIN/MEMBER can open and delete their own drafts, and gets a 404 for someone else's draft (same as partial_update and create_draft_to_issue).

File: apps/api/plane/app/views/workspace/draft.py

I have a fix with contract tests ready and will open a PR.

Steps to reproduce

Member can't open own draft

  1. In a workspace, log in as a user with the Member role.
  2. Create a draft work item (POST /api/workspaces//draft-issues/).
  3. GET /api/workspaces//draft-issues/<draft_id>/
  4. Response: 403 "You don't have the required permissions." (expected 200)

Admin can delete another user's draft

  1. As a Member, create a draft and note its id.
  2. Log in as a workspace Admin.
  3. DELETE /api/workspaces//draft-issues/<member_draft_id>/
  4. Response: 204 and the member's draft is deleted (expected 404)
Environment

Production

Browser

None

Edition

Community

Version

0.17.0-dev

Lenguaje dominante
TypeScript
Estrellas
60.7k
Forks
6k
Merge medio
1 d 11 h
PR fusionados (30 d)
79

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de makeplane/plane

Todos los issues de makeplane/plane

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.