Internal
Public Access
Keith SmithandClaude Sonnet 4.5
a2097dcad3
Fixed security vulnerability where users could reference any tag in the system when creating/updating tasks. Changes: tasks/serializers.py (TaskSerializer): - Added __init__() method to override tag_ids queryset - Filter Tag.objects.all() to Tag.objects.filter(user=request.user) - Only allows users to assign their own tags to tasks - Prevents information disclosure via tag enumeration Security impact: - Prevents users from accessing other users' tag IDs - Blocks unauthorized tag association - Protects tag privacy and prevents enumeration attacks - Enforces proper authorization on tag-task relationships 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>