Skip to content

fix(Segments): Fix project reference in segment creation#6929

Merged
gagantrivedi merged 5 commits intomainfrom
fix/create-segment-project-reference
Mar 13, 2026
Merged

fix(Segments): Fix project reference in segment creation#6929
gagantrivedi merged 5 commits intomainfrom
fix/create-segment-project-reference

Conversation

@emyller
Copy link
Copy Markdown
Contributor

@emyller emyller commented Mar 12, 2026

Thanks for submitting a PR! Please check the boxes below:

  • I have read the Contributing Guide.
  • I have added information to docs/ if required so people know about the feature.
  • I have filled in the "Changes" section below.
  • I have filled in the "How did you test this code" section below.

Changes

Closes #6914.

This patch prevents referencing any project when creating a segment, restricting to the one referenced in the URL, which has its association with the user validated.

How did you test this code?

Included unit tests.

@emyller emyller self-assigned this Mar 12, 2026
@emyller emyller requested a review from a team as a code owner March 12, 2026 00:32
@emyller emyller requested review from gagantrivedi and removed request for a team March 12, 2026 00:32
@vercel
Copy link
Copy Markdown

vercel bot commented Mar 12, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments
Project Deployment Actions Updated (UTC)
docs Ignored Ignored Preview Mar 12, 2026 6:12pm
flagsmith-frontend-preview Ignored Ignored Preview Mar 12, 2026 6:12pm
flagsmith-frontend-staging Ignored Ignored Preview Mar 12, 2026 6:12pm

Request Review

@github-actions github-actions bot added api Issue related to the REST API fix labels Mar 12, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 12, 2026

Docker builds report

Image Build Status Security report
ghcr.io/flagsmith/flagsmith-e2e:pr-6929 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith-frontend:pr-6929 Finished ✅ Results
ghcr.io/flagsmith/flagsmith-api-test:pr-6929 Finished ✅ Skipped
ghcr.io/flagsmith/flagsmith:pr-6929 Finished ✅ Results
ghcr.io/flagsmith/flagsmith-private-cloud:pr-6929 Finished ✅ Results
ghcr.io/flagsmith/flagsmith-api:pr-6929 Finished ✅ Results

Copy link
Copy Markdown

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Free Tier Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

  • ✅ Fixed: Test doesn't verify successful creation, masks failures
    • The test now asserts a 201 response and verifies the new segment is created in the URL project while still ensuring nothing is created in the other project.

Create PR

Or push these changes by commenting:

@cursor push 55ce27cb21
Preview (55ce27cb21)
diff --git a/api/tests/unit/segments/test_unit_segments_views.py b/api/tests/unit/segments/test_unit_segments_views.py
--- a/api/tests/unit/segments/test_unit_segments_views.py
+++ b/api/tests/unit/segments/test_unit_segments_views.py
@@ -1895,7 +1895,7 @@
     other_project = Project.objects.create(name="Other Project", organisation=other_org)
 
     # When
-    admin_client.post(
+    response = admin_client.post(
         f"/api/v1/projects/{project.id}/segments/",
         data={
             "name": "a_wild_pokemon",
@@ -1906,4 +1906,6 @@
     )
 
     # Then
+    assert response.status_code == status.HTTP_201_CREATED
+    assert Segment.objects.filter(project=project, name="a_wild_pokemon").exists()
     assert not Segment.objects.filter(project=other_project).exists()

This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.

@codecov
Copy link
Copy Markdown

codecov bot commented Mar 12, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.31%. Comparing base (dbd66e9) to head (3a96a9f).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #6929   +/-   ##
=======================================
  Coverage   98.31%   98.31%           
=======================================
  Files        1335     1335           
  Lines       49717    49730   +13     
=======================================
+ Hits        48879    48892   +13     
  Misses        838      838           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 12, 2026

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  27.5 seconds
commit  9d669cf
info  🔄 Run: #15250 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  29.1 seconds
commit  9d669cf
info  🔄 Run: #15250 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  16 passed

Details

stats  16 tests across 13 suites
duration  59.5 seconds
commit  9d669cf
info  🔄 Run: #15250 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  16 passed

Details

stats  16 tests across 13 suites
duration  28.8 seconds
commit  9d669cf
info  🔄 Run: #15250 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  11 seconds
commit  4e9710b
info  🔄 Run: #15251 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  10.2 seconds
commit  4e9710b
info  🔄 Run: #15251 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  29.1 seconds
commit  9d8eb8e
info  🔄 Run: #15252 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  46.9 seconds
commit  9d8eb8e
info  🔄 Run: #15252 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  49.1 seconds
commit  6e5a709
info  🔄 Run: #15262 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  53.3 seconds
commit  6e5a709
info  🔄 Run: #15262 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  16 passed

Details

stats  16 tests across 13 suites
duration  35.2 seconds
commit  6e5a709
info  🔄 Run: #15262 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  1 minute, 4 seconds
commit  6e5a709
info  🔄 Run: #15262 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  42.9 seconds
commit  94a1a22
info  🔄 Run: #15267 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  42.6 seconds
commit  eef717e
info  🔄 Run: #15268 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  28.6 seconds
commit  eef717e
info  🔄 Run: #15268 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  11.9 seconds
commit  94a1a22
info  🔄 Run: #15267 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  53.3 seconds
commit  94a1a22
info  🔄 Run: #15267 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  16 passed

Details

stats  16 tests across 13 suites
duration  56.3 seconds
commit  eef717e
info  🔄 Run: #15268 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  1 minute, 1 second
commit  94a1a22
info  🔄 Run: #15267 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  1 minute, 3 seconds
commit  eef717e
info  🔄 Run: #15268 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

passed  16 passed

Details

stats  16 tests across 13 suites
duration  1 minute, 1 second
commit  3a96a9f
info  🔄 Run: #15272 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  47.3 seconds
commit  3a96a9f
info  🔄 Run: #15272 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  10 passed

Details

stats  10 tests across 7 suites
duration  49.1 seconds
commit  3a96a9f
info  🔄 Run: #15272 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  1 minute
commit  3a96a9f
info  🔄 Run: #15272 (attempt 1)

@github-actions github-actions bot added fix and removed fix labels Mar 12, 2026
Copy link
Copy Markdown

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

@emyller emyller force-pushed the fix/create-segment-project-reference branch from 9d8eb8e to 6e5a709 Compare March 12, 2026 14:45
@cursor
Copy link
Copy Markdown

cursor bot commented Mar 12, 2026

You have run out of free Bugbot PR reviews for this billing cycle. This will reset on April 10.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

@github-actions github-actions bot added fix and removed fix labels Mar 12, 2026
@github-actions github-actions bot added fix and removed fix labels Mar 12, 2026
@github-actions github-actions bot added fix and removed fix labels Mar 12, 2026
@github-actions github-actions bot added fix and removed fix labels Mar 12, 2026
@gagantrivedi gagantrivedi merged commit b905af2 into main Mar 13, 2026
33 checks passed
@gagantrivedi gagantrivedi deleted the fix/create-segment-project-reference branch March 13, 2026 02:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

api Issue related to the REST API fix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Investigate potential security vulnerability - Unauthorized Access To Add Segments In All User Accounts Via IDOR

3 participants