[SECUR-103] fix: Insecure Direct Object Reference on feature flags endpoint#5718

2026-02-04 16:30:18 +05:30
parent a55d0b4a9a
commit 37ff1b8cab
1 changed files with 3 additions and 0 deletions
@@ -27,9 +27,12 @@ from plane.payment.views.base import BaseAPIView
 from plane.db.models import DeployBoard
 from plane.utils.exception_logger import log_exception
 from plane.space.rate_limit import AnchorBasedRateThrottle, SpaceRateThrottle
+from plane.app.permissions.workspace import WorkspaceUserPermission


 class FeatureFlagProxyEndpoint(BaseAPIView):
+    permission_classes = [WorkspaceUserPermission]
+
    def get(self, request, slug):
        try:
            url = f"{settings.FEATURE_FLAG_SERVER_BASE_URL}/api/feature-flags/"