Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[bug]: Workspace drafts: members get 403 on their own draft; admins can delete other users’ drafts

Aperta
  • Qualcosa non va?
#10,001 1 commento 0 reazioni 2 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@vihar ci sta già lavorando.

Dal 13/10/2026.

  • #10006 di @Vishesh-Verma-07 — aperta

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

🐛bug plane
Is there an existing issue for this?
  • I have searched the existing issues
Current behavior

Workspace drafts are meant to be private to their creator. list, partial_update and create_draft_to_issue in WorkspaceDraftIssueViewSet all scope the lookup to created_by=request.user, but two sibling actions don't:

  1. Members get 403 on their own draft.retrieve is decorated with allowed_roles=[ROLE.ADMIN], creator=True, model=Issue. A draft id never exists in the Issue table, so the creator check never matches, and a workspace MEMBER gets {"error": "You don't have the required permissions."} when opening a draft they created.

  2. Admins can delete other users' private drafts. destroy fetches the draft with DraftIssue.objects.get(workspace__slug=slug, pk=pk), with no owner check. A workspace ADMIN can delete another member's draft, even though they can't list or open it.

Expected: any ADMIN/MEMBER can open and delete their own drafts, and gets a 404 for someone else's draft (same as partial_update and create_draft_to_issue).

File: apps/api/plane/app/views/workspace/draft.py

I have a fix with contract tests ready and will open a PR.

Steps to reproduce

Member can't open own draft

  1. In a workspace, log in as a user with the Member role.
  2. Create a draft work item (POST /api/workspaces//draft-issues/).
  3. GET /api/workspaces//draft-issues/<draft_id>/
  4. Response: 403 "You don't have the required permissions." (expected 200)

Admin can delete another user's draft

  1. As a Member, create a draft and note its id.
  2. Log in as a workspace Admin.
  3. DELETE /api/workspaces//draft-issues/<member_draft_id>/
  4. Response: 204 and the member's draft is deleted (expected 404)
Environment

Production

Browser

None

Edition

Community

Version

0.17.0-dev

Lingua principale
TypeScript
Stelle
60.7k
Fork
6k
Merge medio
1g 11h
PR unite (30g)
79

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di makeplane/plane

Tutte le issue di makeplane/plane

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.