sriram veeraghanta 9491bdbe46 fix(api): scope cross-workspace resource lookups to prevent IDOR (#9008) ...

`ProjectViewSet.partial_update`, `BulkEstimatePointEndpoint.partial_update`,
and `WorkspaceUserProfileEndpoint.get` previously fetched objects by primary
key alone after a workspace-scoped permission check, allowing an authenticated
caller to act on resources belonging to other workspaces by supplying a
foreign UUID with their own workspace slug in the URL.

- Project partial_update: scope `Project.objects.get` by `workspace__slug`,
  matching the existing pattern in `destroy`.
- Bulk estimate partial_update: scope `Estimate.objects.get` by
  `workspace__slug` and `project_id`, matching `retrieve` and `destroy`.
- Workspace user profile: require the target `user_id` to be an active
  member of the requested workspace before returning email and other PII.

2026-05-04 17:58:28 +05:30

..

admin

chore: bump up the package version

2026-04-20 17:20:12 +05:30

api

fix(api): scope cross-workspace resource lookups to prevent IDOR (#9008)

2026-05-04 17:58:28 +05:30

live

chore: bump up the package version

2026-04-20 17:20:12 +05:30

proxy

Merge branch 'canary' of github.com:makeplane/plane into preview

2025-12-12 13:42:48 +05:30

space

chore: bump up the package version

2026-04-20 17:20:12 +05:30

web

chore: bump up the package version

2026-04-20 17:20:12 +05:30