* fix: field updates not getting propogated when wi is created
* fix: added fetching of users, as fallback
* feat: added add me to assignees button, and fix assignee override
* fix: resolved error for project linkback
* fix: added slack service for generic content parser
* feat: added method for getting conversation
* fix: cursor and copilot code review
* fix: linter errors
* fix: mock slack service implementation
* fix(security): prevent password reuse during password change and reset
Add validation to disallow users from setting their new password to the
same value as their current password. This addresses a security
vulnerability where attackers could potentially reuse compromised
passwords.
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* fix(security): obfuscate email in URL params and remove from reset password flow
- Encode email as base64 in URL params using 'ctx' parameter to prevent PII exposure
- Remove email from reset password link and form (uidb64/token already identify the user)
- Include uidb64 and token in password validation error redirects so users can retry
- Add encodeEmailForUrl and decodeEmailFromUrl utility functions
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* fix(security): limit concurrent web sessions to 5 per user
Implement session limiting to restrict users to a maximum of 5 concurrent
web sessions. When the limit is exceeded, the oldest web sessions are
automatically removed. Mobile sessions are excluded from this limit.
- Add session_type field to device_info JSON (web/mobile)
- Add enforce_session_limit utility to manage session count
- Add MAX_CONCURRENT_SESSIONS setting (default: 5, env configurable)
Co-Authored-By: Claude Opus 4.5 <[email protected]>
* test: add unit tests for session limit and password reuse prevention
Add unit tests for security features introduced in this branch:
Session limit tests (10 tests):
- Verify web sessions limited to MAX_CONCURRENT_SESSIONS (default 5)
- Verify oldest sessions deleted when limit exceeded
- Verify mobile sessions excluded from limit
- Verify current session protected from deletion
Password reuse prevention tests (8 tests):
- Verify PASSWORD_SAME_AS_CURRENT error when reusing password
- Verify password change succeeds with different password
- Verify error code 5142 properly defined
Co-Authored-By: Claude Opus 4.5 <[email protected]>
---------
Co-authored-by: Claude Opus 4.5 <[email protected]>
The workspace join endpoint previously accepted invitations based only on
email matching without verifying that the request came from the actual
email recipient. This allowed attackers to accept invitations for any
email by simply providing the email in the request.
Changes:
- Replace email-based validation with token-based validation
- Token is now included in invitation URL instead of email
- Backend validates token matches stored invitation token
- Frontend passes token from URL to API instead of email
* fix: disable RequestedAuthnContext in SAML adapter to resolve Azure AD error AADSTS75011
* feat: add SAML_DISABLE_REQUESTED_AUTHN_CONTEXT configuration and update form fields for SAML authentication
* feat: add rate parsing functionality to AuthenticationLimitedThrottle class
* fix: enhance error handling for rate format in AuthenticationLimitedThrottle class
* fix: improve error messages for invalid rate format and duration in AuthenticationLimitedThrottle class
* chore: update live server files with copyright
* chore: update copyright comments for silo server
* chore: update copyright for all packages
* fix: format
* chore: adding copyright to all files in web app
* chore: update copyright in admin app
* chore: copyright comments updated on space app
* fix: formatting in files
* chore: add licence check workflow for Python files
* chore: update licence check workflow to set up Go environment and adjust path
* chore: enhance licence check workflow with error handling and logging
* chore: add proprietary notice to filter migrations utility
* modify github action name
Remove unused imports that caused circular dependency:
- plane.ee.views.base (BaseAPIView, BaseViewSet)
- rest_framework.request (Request)
These were only used for type hints in has_permission() which
doesn't need them since the signature is defined by DRF's BasePermission.
* fix: update user count logic in EnterpriseSubscriptionProrationPreviewEndpoint to use active users instead of workspace license
* fix: set IsActive to true for all members in PopulateDatabaseWithFilePayload function
sriramveeraghanta