Internal
Public Access
Keith SmithandClaude Sonnet 4.5
c50aaa2d81
Added comprehensive authorization checks to prevent users from: 1. Sharing tasks/tags they don't own 2. Modifying tasks/tags that are only shared with them (read-only access) Changes: tasks/serializers.py (TaskShareSerializer): - Added validation in validate() method to verify task/tag ownership - Users can only share their own tasks and tags - Prevents malicious users from sharing other people's resources tasks/permissions.py (NEW): - Created IsOwnerOrReadOnlyIfShared permission class - Owners: full access (read, update, delete) - Shared users: read-only access - Prevents privilege escalation via shared access tasks/views.py: - Applied IsOwnerOrReadOnlyIfShared to TaskDetailAPIView - Applied IsOwnerOrReadOnlyIfShared to TagDetailAPIView - Enforces object-level permissions on all update/delete operations Security impact: - Prevents users from modifying or deleting resources they don't own - Prevents users from sharing resources they don't own - Maintains proper separation between owner and shared access levels 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>