Fix MEDIUM-HIGH Security Issue: Restrict tag queryset to user's own tags

Fixed security vulnerability where users could reference any tag in the system when creating/updating tasks.

Changes:

tasks/serializers.py (TaskSerializer):
- Added __init__() method to override tag_ids queryset
- Filter Tag.objects.all() to Tag.objects.filter(user=request.user)
- Only allows users to assign their own tags to tasks
- Prevents information disclosure via tag enumeration

Security impact:
- Prevents users from accessing other users' tag IDs
- Blocks unauthorized tag association
- Protects tag privacy and prevents enumeration attacks
- Enforces proper authorization on tag-task relationships

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

tasks/serializers.py

@@ -65,6 +65,13 @@ class TaskSerializer(serializers.ModelSerializer):
     total_time_spent = serializers.ReadOnlyField()
     parent_sync_id = serializers.UUIDField(source='parent.sync_id', read_only=True, allow_null=True)
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        # SECURITY: Filter tag queryset to only include tags owned by the current user
+        request = self.context.get('request')
+        if request and hasattr(request, 'user') and request.user.is_authenticated:
+            self.fields['tag_ids'].queryset = Tag.objects.filter(user=request.user)
+
     class Meta:
         model = Task
         fields = [