Fix plugin state viewer org filter (#3640)

* updated PR automation Slow run to avoid executing all the optional containers

* fix(views): scope plugin_state_viewer to user organization

This prevents a cross-organization information disclosure where users could see disabled plugin states from all organizations.

---------

Co-authored-by: Daniele Rosetti <55402684+drosetti@users.noreply.github.com>
Co-authored-by: Matteo Lodi <30625432+mlodic@users.noreply.github.com>

Author: 3 people

api_app/views.py

@@ -948,7 +948,10 @@ def plugin_state_viewer(request):
         raise PermissionDenied()
 
     result = {"data": {}}
-    for opc in OrganizationPluginConfiguration.objects.filter(disabled=True):
+    for opc in OrganizationPluginConfiguration.objects.filter(
+        disabled=True,
+        organization=request.user.membership.organization,
+    ):
         result["data"][opc.config.name] = {
             "disabled": True,
         }