mirror of
https://github.com/makeplane/plane.git
synced 2026-06-14 03:30:00 +00:00
sriram veeraghanta
9a30a07cf5
The public REST API GenericAssetEndpoint (/api/v1/workspaces/<slug>/assets/) declared no permission class, inheriting only IsAuthenticated. Since APIKeyAuthentication does not bind a token to a workspace and the workspace is read straight from the URL slug, any valid Personal Access Token could read (GET), create (POST), and modify (PATCH) assets in a workspace the caller is not a member of — a cross-workspace IDOR, the public-API sibling of the CVE-2026-46558 dashboard asset fix. Add permission_classes = [WorkspaceUserPermission] so every method requires active workspace membership, matching the dashboard fix semantics. Also add contract regression tests covering cross-workspace GET/POST/PATCH (now 403) and a positive control confirming members retain access. Also ignore the local /security/ advisory notes folder.
120 lines
1.2 KiB
Plaintext
120 lines
1.2 KiB
Plaintext
node_modules
|
|
.next
|
|
.yarn
|
|
|
|
### NextJS ###
|
|
# Dependencies
|
|
/node_modules
|
|
/.pnp
|
|
.pnp.js
|
|
|
|
# Testing
|
|
/coverage
|
|
|
|
# Next.js
|
|
/.next/
|
|
/out/
|
|
|
|
# Production
|
|
dist/
|
|
out/
|
|
build/
|
|
.react-router/
|
|
|
|
# Misc
|
|
.DS_Store
|
|
*.pem
|
|
.history
|
|
tsconfig.tsbuildinfo
|
|
|
|
# Debug
|
|
npm-debug.log*
|
|
yarn-debug.log*
|
|
yarn-error.log*
|
|
pnpm-debug.log*
|
|
.pnpm-debug.log*
|
|
|
|
# Local env files
|
|
.env
|
|
.env.local
|
|
.env.development.local
|
|
.env.test.local
|
|
.env.production.local
|
|
|
|
# Vercel
|
|
.vercel
|
|
|
|
# Turborepo
|
|
.turbo
|
|
|
|
## Django ##
|
|
venv
|
|
.venv
|
|
*.pyc
|
|
staticfiles
|
|
mediafiles
|
|
.env
|
|
.DS_Store
|
|
logs/
|
|
htmlcov/
|
|
.coverage
|
|
|
|
node_modules/
|
|
assets/dist/
|
|
npm-debug.log
|
|
yarn-error.log
|
|
pnpm-debug.log
|
|
|
|
# Editor directories and files
|
|
.idea
|
|
*.suo
|
|
*.ntvs*
|
|
*.njsproj
|
|
*.sln
|
|
package-lock.json
|
|
.vscode
|
|
|
|
# Sentry
|
|
.sentryclirc
|
|
|
|
# lock files
|
|
package-lock.json
|
|
|
|
|
|
|
|
.secrets
|
|
tmp/
|
|
|
|
## packages
|
|
dist
|
|
.temp/
|
|
deploy/selfhost/plane-app/
|
|
|
|
## Storybook
|
|
*storybook.log
|
|
output.css
|
|
|
|
dev-editor
|
|
# Redis
|
|
*.rdb
|
|
*.rdb.gz
|
|
|
|
storybook-static
|
|
|
|
CLAUDE.md
|
|
|
|
build/
|
|
.react-router/
|
|
|
|
build/
|
|
.react-router/
|
|
temp/
|
|
scripts/
|
|
!packages/i18n/scripts/
|
|
|
|
# i18n auto-generated types (regenerated on every build)
|
|
packages/i18n/src/types/keys.generated.ts
|
|
|
|
# Local security notes (not for version control)
|
|
/security/
|