[bug]: Workspace drafts: members get 403 on their own draft; admins can delete other users’ drafts
Maintainers usually reply within 1 day
Assessment
This issue has not been assessed yet.
Description
Is there an existing issue for this?
- I have searched the existing issues
Current behavior
Workspace drafts are meant to be private to their creator. list, partial_update and create_draft_to_issue in WorkspaceDraftIssueViewSet all scope the lookup to created_by=request.user, but two sibling actions don't:
-
Members get 403 on their own draft.
retrieveis decorated withallowed_roles=[ROLE.ADMIN], creator=True, model=Issue. A draft id never exists in theIssuetable, so the creator check never matches, and a workspace MEMBER gets{"error": "You don't have the required permissions."}when opening a draft they created. -
Admins can delete other users' private drafts.
destroyfetches the draft withDraftIssue.objects.get(workspace__slug=slug, pk=pk), with no owner check. A workspace ADMIN can delete another member's draft, even though they can't list or open it.
Expected: any ADMIN/MEMBER can open and delete their own drafts, and gets a 404 for someone else's draft (same as partial_update and create_draft_to_issue).
File: apps/api/plane/app/views/workspace/draft.py
I have a fix with contract tests ready and will open a PR.
Steps to reproduce
Member can't open own draft
- In a workspace, log in as a user with the Member role.
- Create a draft work item (POST /api/workspaces//draft-issues/).
- GET /api/workspaces//draft-issues/<draft_id>/
- Response: 403 "You don't have the required permissions." (expected 200)
Admin can delete another user's draft
- As a Member, create a draft and note its id.
- Log in as a workspace Admin.
- DELETE /api/workspaces//draft-issues/<member_draft_id>/
- Response: 204 and the member's draft is deleted (expected 404)
Environment
Production
Browser
None
Edition
Community
Version
0.17.0-dev
- Dominant language
- TypeScript
- Stars
- 60.7k
- Forks
- 6k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 79
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from makeplane/plane
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
[bug]: Email notifications show a broken avatar for users without a profile photoPossibly taken @gurnoorpannu claimed this 4 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
makeplane/plane#10009 · 1 comment ·
Maintainers usually reply within 1 day
-
🐛 Bug: Calendar work items cannot be opened on mobilePossibly taken @pennnnnnnnnn claimed this 6 days ago. Open
Difficulty 1/5 Under an hour Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
[bug]: First day of the week section not translated when Idioma is EspañolPossibly taken @deepcfr claimed this 9 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
makeplane/plane#9967 · 2 comments ·
Maintainers usually reply within 1 day
-
[bug]: First day of the week section not translated when Idioma is EspañolPossibly taken @Indira-kumar claimed this 7 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
Similar issues
-
freshness freshness:observed-only
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
thoroc/context-radar#280 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
-
documentation story
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day
-
bug category:billing priority:p3 track:fast
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
LanternOps/breeze#9223 ·
Maintainers usually reply within 1 day