binarybeach/bb-plane-fork
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: Member Information Disclosure via Public Endpoint #8646

Browse source
This commit is contained in:
sriram veeraghanta 2026-02-20 18:33:45 +05:30 • committed by GitHub
parent 9070acbbe8
commit f53446340b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 8 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

10
apps/api/plane/space/views/project.py
View file

@ -67,6 +67,11 @@ class ProjectMembersEndpoint(BaseAPIView):
def get(self, request, anchor):
deploy_board = DeployBoard.objects.filter(anchor=anchor).first()
if not deploy_board:
return Response(
{"error": "Invalid anchor"},
status=status.HTTP_404_NOT_FOUND,
)
members = ProjectMember.objects.filter(
project=deploy_board.project,
@ -75,10 +80,7 @@ class ProjectMembersEndpoint(BaseAPIView):
).values(
"id",
"member",
"member__first_name",
"member__last_name",
"member__display_name",
"project",
"workspace",
"member__avatar",
)
return Response(members, status=status.HTTP_200_OK)

6
apps/space/core/types/member.d.ts vendored
View file

@ -1,10 +1,6 @@
export type TPublicMember = {
id: string;
member: string;
member__avatar: string;
member__first_name: string;
member__last_name: string;
member__display_name: string;
project: string;
workspace: string;
member__avatar: string;
};

6
packages/types/src/users.ts
View file

@ -194,12 +194,8 @@ export type TProfileViews = "assigned" | "created" | "subscribed";
export type TPublicMember = {
id: string;
member: string;
member__avatar: string;
member__first_name: string;
member__last_name: string;
member__display_name: string;
project: string;
workspace: string;
member__avatar: string;
};
// export interface ICurrentUser {