The workspace join endpoint previously accepted invitations based only on
email matching without verifying that the request came from the actual
email recipient. This allowed attackers to accept invitations for any
email by simply providing the email in the request.
Changes:
- Replace email-based validation with token-based validation
- Token is now included in invitation URL instead of email
- Backend validates token matches stored invitation token
- Frontend passes token from URL to API instead of email
* fix: disable RequestedAuthnContext in SAML adapter to resolve Azure AD error AADSTS75011
* feat: add SAML_DISABLE_REQUESTED_AUTHN_CONTEXT configuration and update form fields for SAML authentication
* feat: add rate parsing functionality to AuthenticationLimitedThrottle class
* fix: enhance error handling for rate format in AuthenticationLimitedThrottle class
* fix: improve error messages for invalid rate format and duration in AuthenticationLimitedThrottle class
Remove unused imports that caused circular dependency:
- plane.ee.views.base (BaseAPIView, BaseViewSet)
- rest_framework.request (Request)
These were only used for type hints in has_permission() which
doesn't need them since the signature is defined by DRF's BasePermission.
* fix: update user count logic in EnterpriseSubscriptionProrationPreviewEndpoint to use active users instead of workspace license
* fix: set IsActive to true for all members in PopulateDatabaseWithFilePayload function
* chore: merge ee api to api folder
* fix: moved epic serializer
* fix: import fix
* fix: removing folders from external apis
* fix: update serilizers of ee enternal endpoints
* fix: update imports
- Replaced WorkspaceMember with User model for fetching active users.
- Adjusted user annotations to reflect the new model structure.
- Updated the license activation request to use the modified user list.
* feat: add Domain and IdentityProvider models for SSO integration, along with related migrations and constraints
* Merge branch 'preview' of github.com:makeplane/plane-ee into cloud-sso
* feat: enhance domain model with verification status and constraints
- Added verification status field to Domain model with choices for pending, verified, and failed.
- Updated verification_token field to allow longer tokens.
- Introduced unique constraints for verified domains and workspace-domain combinations.
- Implemented domain verification logic with DNS TXT record checks.
- Added methods for domain management, including creation and verification status checks.
* feat: add auto_join_role and is_auto_join_enabled fields to workspacefeature model
* refactor: update domain verification error codes and improve SSO model attributes
- Changed error code and message for domain verification in the Domain model.
- Renamed logout_url to slo_url in the IdentityProvider model for clarity.
- Updated provider checks in the IdentityProvider save method to use constants.
- Simplified string representation in the IdentityProvider model.
- Modified WorkspaceRole to use IntegerChoices for better type safety.
- Adjusted migration to reflect changes in WorkspaceRole choices.
* feat: implement cloud SSO support with OIDC and SAML authentication endpoints
- Added new endpoints for SSO authentication including OIDC and SAML.
- Introduced serializers for domain and identity provider management.
- Enhanced error handling for authentication processes.
- Updated URL routing to accommodate new SSO features.
- Implemented domain verification and management functionalities.
- Added feature flags for cloud SSO capabilities.
- Refactored existing authentication logic to integrate with new SSO providers.
* feat: add identity management and SSO features
- Updated configuration to disable self-managed mode for cloud SSO.
- Introduced new components and pages for identity management, including OIDC and SAML provider setups.
- Added domain management functionalities for SSO.
- Enhanced sidebar with identity settings icon.
- Implemented internationalization support for identity-related texts.
- Created utility functions and services for handling SSO domains and providers.
- Updated routing and feature flags to support new identity features.
---------
Co-authored-by: Prateek Shourya <[email protected]>
Co-authored-by: sriram veeraghanta <[email protected]>
* migration: added version field in webhook
* chore: add max_length
* chore: added product tour fields
* chore: updated the migration file
* chore: removed the duplicated migration file
* chore: added allowed_rate_limit for api_tokens
* chore: changed key feature tour to product tour
* chore: added is_subscribed_to_changelog field
---------
Co-authored-by: NarayanBavisetti <[email protected]>
* [WEB-5460] feat: add 'is null' filter support for work item and initiative filters.
* improve 'is null' filters to exclude soft-deleted associations in ExtendedIssueFilterSet and InitiativeFilterSet
* Custom properties isnull filter
* improvement: enhance work item filters by excluding is null operator for name property and disabling is not null
* enhancement: add forceUpdate parameter to updateConditionValue method for filter optimization
* refactor: remove TFilterValue from filter configuration types for improved type consistency
---------
Co-authored-by: Dheeraj Kumar Ketireddy <[email protected]>
* fix: using base url of a redirect url
* chore: internal networks check for the final_url
* fix: none final_url
* fix: exception handling
* fix: exception handling
* chore: remove unused imports
* refactor: moved ip address check logic into separate function
* fix: ValueError logic
