Skip to content

Commit b8a41ad

Browse files
[WEB-5560] fix: restrict guest users to view all details of a workspace members (#8215)
* fix: separate retrieve method in WorkspaceMemberViewSet * fix: non project members accessing member detail: * chore: error handle * fix: role based response * fix: use Enum
1 parent 7c74d0a commit b8a41ad

File tree

2 files changed

+53
-0
lines changed

2 files changed

+53
-0
lines changed

apps/api/plane/app/views/project/member.py

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,40 @@ def list(self, request, slug, project_id):
164164
serializer = ProjectMemberRoleSerializer(project_members, fields=("id", "member", "role"), many=True)
165165
return Response(serializer.data, status=status.HTTP_200_OK)
166166

167+
@allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
168+
def retrieve(self, request, slug, project_id, pk):
169+
requesting_project_member = ProjectMember.objects.get(
170+
project_id=project_id,
171+
workspace__slug=slug,
172+
member=request.user,
173+
is_active=True,
174+
)
175+
176+
project_member = (
177+
ProjectMember.objects.filter(
178+
pk=pk,
179+
project_id=project_id,
180+
workspace__slug=slug,
181+
member__is_bot=False,
182+
is_active=True,
183+
)
184+
.select_related("project", "member", "workspace")
185+
.first()
186+
)
187+
188+
if not project_member:
189+
return Response(
190+
{"error": "Project member not found"},
191+
status=status.HTTP_404_NOT_FOUND,
192+
)
193+
194+
if requesting_project_member.role > ROLE.GUEST.value:
195+
serializer = ProjectMemberAdminSerializer(project_member)
196+
else:
197+
serializer = ProjectMemberRoleSerializer(project_member, fields=("id", "member", "role"))
198+
199+
return Response(serializer.data, status=status.HTTP_200_OK)
200+
167201
@allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
168202
def partial_update(self, request, slug, project_id, pk):
169203
project_member = ProjectMember.objects.get(pk=pk, workspace__slug=slug, project_id=project_id, is_active=True)

apps/api/plane/app/views/workspace/member.py

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,25 @@ def list(self, request, slug):
5050
serializer = WorkSpaceMemberSerializer(workspace_members, fields=("id", "member", "role"), many=True)
5151
return Response(serializer.data, status=status.HTTP_200_OK)
5252

53+
@allow_permission(allowed_roles=[ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST], level="WORKSPACE")
54+
def retrieve(self, request, slug, pk):
55+
workspace_member = WorkspaceMember.objects.get(member=request.user, workspace__slug=slug, is_active=True)
56+
57+
try:
58+
# Get the specific workspace member by pk
59+
member = self.get_queryset().get(pk=pk)
60+
except WorkspaceMember.DoesNotExist:
61+
return Response(
62+
{"error": "Workspace member not found"},
63+
status=status.HTTP_404_NOT_FOUND,
64+
)
65+
66+
if workspace_member.role > ROLE.GUEST.value:
67+
serializer = WorkspaceMemberAdminSerializer(member, fields=("id", "member", "role"))
68+
else:
69+
serializer = WorkSpaceMemberSerializer(member, fields=("id", "member", "role"))
70+
return Response(serializer.data, status=status.HTTP_200_OK)
71+
5372
@allow_permission(allowed_roles=[ROLE.ADMIN], level="WORKSPACE")
5473
def partial_update(self, request, slug, pk):
5574
workspace_member = WorkspaceMember.objects.get(

0 commit comments

Comments
 (0)