hardening(space): add project_id scope to destroy()/partial_update() lookups in public board views
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
Research direction
Open apps/api/plane/space/views/issue.py and locate IssueCommentPublicViewSet.partial_update(), IssueCommentPublicViewSet.destroy(), and IssueReactionPublicViewSet.destroy(). Ensure the object lookups include the board's project_id while retaining the stated actor and workspace constraints, then verify that operations cannot cross project boundaries within a workspace.
Written by the indexing model from the issue text.
Description
Summary
IssueReactionPublicViewSet.destroy() and IssueCommentPublicViewSet.partial_update() / destroy() fetch objects by pk + actor=request.user without additionally scoping to the board's project_id. This is a defense-in-depth gap.
Current Behavior
# IssueCommentPublicViewSet.partial_update() and destroy()
comment = IssueComment.objects.get(pk=pk, actor=request.user)
# No project_id or workspace_id constraint
# IssueReactionPublicViewSet.destroy()
issue_reaction = IssueReaction.objects.get(
workspace_id=project_deploy_board.workspace_id,
issue_id=issue_id,
reaction=reaction_code,
actor=request.user,
)
# Missing: project_id=project_deploy_board.project_id
Security Impact
Low. All lookups include actor=request.user — users can only affect their own objects. However, without project_id scoping, a user could modify/delete their own comment via a board from a different project within the same workspace, or delete their own reaction via any board in the workspace.
Recommended Fix
# IssueCommentPublicViewSet.partial_update() and destroy()
comment = IssueComment.objects.get(
pk=pk,
actor=request.user,
project_id=project_deploy_board.project_id,
workspace_id=project_deploy_board.workspace_id,
)
# IssueReactionPublicViewSet.destroy()
issue_reaction = IssueReaction.objects.get(
workspace_id=project_deploy_board.workspace_id,
project_id=project_deploy_board.project_id, # add
issue_id=issue_id,
reaction=reaction_code,
actor=request.user,
)
Affected File
apps/api/plane/space/views/issue.py
Related
Identified during security audit of PR #9498. Pre-existing issue, not introduced by that PR.
- Dominant language
- TypeScript
- Stars
- 59.6k
- Forks
- 5.8k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 49
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from makeplane/plane
-
[bug]: Expired session causes endless reload loop / error boundary instead of the sign-in screen Open
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
Similar issues
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 91/100
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100