Skip to content

fix: IDOR in IssueBulkUpdateDateEndpoint (GHSA-4q54-h4x9-m329) #8834

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sriramveeraghanta merged 1 commit into from
Mar 31, 2026
+1 −1
Merged

fix: IDOR in IssueBulkUpdateDateEndpoint (GHSA-4q54-h4x9-m329) #8834

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apps/api/plane/app/views/issue/base.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1118,7 +1118,7 @@ def post(self, request, slug, project_id):
epoch = int(timezone.now().timestamp())

# Fetch all relevant issues in a single query
issues = list(Issue.objects.filter(id__in=issue_ids))
issues = list(Issue.objects.filter(id__in=issue_ids, workspace__slug=slug, project_id=project_id))
issues_dict = {str(issue.id): issue for issue in issues}
Comment on lines 1120 to 1122
Copy link

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This endpoint fetches issues via the default Issue.objects manager. Unlike Issue.issue_objects, this will include triage/archived/draft issues (see IssueManager.get_queryset()), which is inconsistent with other issue endpoints in this file that operate on Issue.issue_objects. If bulk date updates should only apply to “active” issues, consider switching this query to Issue.issue_objects.filter(...) (and keep the same workspace/project scoping). If the broader scope is intentional, it’d help to document why here to avoid future authorization/behavior inconsistencies.

Copilot uses AI. Check for mistakes.
issues_to_update = []

Expand Down
Loading