From 302e446611f9ed93a03a6933ea435383c0ddf6f1 Mon Sep 17 00:00:00 2001 From: NarayanBavisetti Date: Fri, 20 Mar 2026 17:15:19 +0530 Subject: [PATCH] chore: added workspace member check in allow permission for creator --- apps/api/plane/app/permissions/base.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/apps/api/plane/app/permissions/base.py b/apps/api/plane/app/permissions/base.py index 7b243cbb789..9c451ed86ab 100644 --- a/apps/api/plane/app/permissions/base.py +++ b/apps/api/plane/app/permissions/base.py @@ -22,6 +22,17 @@ def decorator(view_func): def _wrapped_view(instance, request, *args, **kwargs): # Check for creator if required if creator and model: + # check if the user is part of the workspace or not + if not WorkspaceMember.objects.filter( + member=request.user, + workspace__slug=kwargs["slug"], + is_active=True, + ).exists(): + return Response( + {"error": "You don't have the required permissions."}, + status=status.HTTP_403_FORBIDDEN, + ) + obj = model.objects.filter(id=kwargs["pk"], created_by=request.user).exists() if obj: return view_func(instance, request, *args, **kwargs)