Skip to content

[WEB-8283] fix: bind Spaces board object IDs to the anchor's project #9442

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mguptahub wants to merge 4 commits into
base: preview
Choose a base branch
from
+452 −1
Open

[WEB-8283] fix: bind Spaces board object IDs to the anchor's project #9442

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6a7fd87
[WEB-8283] fix: bind Spaces board object IDs to the anchor's project …
mguptahub Jul 20, 2026
24faac6
[WEB-8283] test: address Copilot review — cross-workspace + votes-dis…
mguptahub Jul 20, 2026
06de0d6
[WEB-8283] refactor: extract board-scope guards into shared helpers
mguptahub Jul 20, 2026
bca77d9
chore(security): drop advisory identifiers from code comments
mguptahub Aug 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions apps/api/plane/space/views/intake.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,14 @@ def create(self, request, anchor, intake_id):
status=status.HTTP_400_BAD_REQUEST,
)

# Ensure the intake belongs to this board before writing
# (GHSA-vqr2-wx56-gmq4: caller-supplied intake_id must be bound to the anchor).
if str(intake_id) != str(project_deploy_board.intake_id):
return Response(
{"error": "Intake does not belong to this Project Board"},
status=status.HTTP_400_BAD_REQUEST,
)

if not request.data.get("issue", {}).get("name", False):
return Response({"error": "Name is required"}, status=status.HTTP_400_BAD_REQUEST)

Expand Down
45 changes: 45 additions & 0 deletions apps/api/plane/space/views/issue.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,6 +233,7 @@ def get_queryset(self):
super()
.get_queryset()
.filter(workspace_id=project_deploy_board.workspace_id)
.filter(project_id=project_deploy_board.project_id)
.filter(issue_id=self.kwargs.get("issue_id"))
.filter(access="EXTERNAL")
.select_related("project")
Expand Down Expand Up @@ -263,6 +264,15 @@ def create(self, request, anchor, issue_id):
status=status.HTTP_400_BAD_REQUEST,
)

# Ensure the issue belongs to this board's project before writing
# (GHSA-vqr2-wx56-gmq4: caller-supplied issue_id must be bound to the anchor).
if not Issue.issue_objects.filter(
id=issue_id,
project_id=project_deploy_board.project_id,
workspace_id=project_deploy_board.workspace_id,
).exists():
Comment thread
mguptahub marked this conversation as resolved.
Outdated
return Response({"error": "Issue not found"}, status=status.HTTP_404_NOT_FOUND)

Comment thread
mguptahub marked this conversation as resolved.
Outdated
serializer = IssueCommentSerializer(data=request.data)
if serializer.is_valid():
serializer.save(
Expand Down Expand Up @@ -372,6 +382,15 @@ def create(self, request, anchor, issue_id):
status=status.HTTP_400_BAD_REQUEST,
)

# Ensure the issue belongs to this board's project before writing
# (GHSA-vqr2-wx56-gmq4: caller-supplied issue_id must be bound to the anchor).
if not Issue.issue_objects.filter(
id=issue_id,
project_id=project_deploy_board.project_id,
workspace_id=project_deploy_board.workspace_id,
).exists():
return Response({"error": "Issue not found"}, status=status.HTTP_404_NOT_FOUND)

serializer = IssueReactionSerializer(data=request.data)
if serializer.is_valid():
serializer.save(
Expand Down Expand Up @@ -457,6 +476,16 @@ def create(self, request, anchor, comment_id):
status=status.HTTP_400_BAD_REQUEST,
)

# Ensure the comment belongs to this board's project before writing
# (GHSA-vqr2-wx56-gmq4: caller-supplied comment_id must be bound to the anchor).
if not IssueComment.objects.filter(
id=comment_id,
project_id=project_deploy_board.project_id,
workspace_id=project_deploy_board.workspace_id,
access="EXTERNAL",
).exists():
return Response({"error": "Comment not found"}, status=status.HTTP_404_NOT_FOUND)

serializer = CommentReactionSerializer(data=request.data)
if serializer.is_valid():
serializer.save(
Expand Down Expand Up @@ -542,6 +571,22 @@ def get_queryset(self):

def create(self, request, anchor, issue_id):
project_deploy_board = DeployBoard.objects.get(anchor=anchor, entity_name="project")

if not project_deploy_board.is_votes_enabled:
return Response(
{"error": "Votes are not enabled for this project board"},
status=status.HTTP_400_BAD_REQUEST,
)
Comment thread
mguptahub marked this conversation as resolved.

# Ensure the issue belongs to this board's project before writing
# (GHSA-vqr2-wx56-gmq4: caller-supplied issue_id must be bound to the anchor).
if not Issue.issue_objects.filter(
id=issue_id,
project_id=project_deploy_board.project_id,
workspace_id=project_deploy_board.workspace_id,
).exists():
return Response({"error": "Issue not found"}, status=status.HTTP_404_NOT_FOUND)

issue_vote, _ = IssueVote.objects.get_or_create(
actor_id=request.user.id,
project_id=project_deploy_board.project_id,
Expand Down
Loading
Loading