Mark's skepticism resolution

[dcramer]

Fixes a High severity IDOR (Indirect Object Reference) vulnerability in the PromptsActivityEndpoint.

Previously, the endpoint allowed users to dismiss prompts for any project_id as long as it existed, without verifying that the project belonged to the user's organization. This allowed unauthorized prompt dismissals for projects in other organizations.

The fix adds organization_id=request.organization.id to the Project.objects.filter query when validating project_id, ensuring that only projects belonging to the current organization can be referenced. A new regression test has been added, and an existing test updated.

Legal Boilerplate

Look, I get it. The entity doing business as "Sentry" was incorporated in the State of Delaware in 2015 as Functional Software, Inc. and is gonna need some rights from me in order to utilize my contributions in this here PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Sentry can use, modify, copy, and redistribute my contributions, under Sentry's choice of terms.

---

Slack Thread

 

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

[codecov]

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
30567	1	30566	241

View the top 1 failed test(s) by shortest run time

tests.sentry.api.endpoints.test_prompts_activity.PromptsActivityTest::test_invalid_project

Stack Traces | 2.58s run time

#x1B[1m#x1B[.../api/endpoints/test_prompts_activity.py#x1B[0m:96: in test_invalid_project
    assert resp.data["detail"] == "Project does not belong to this organization"
#x1B[1m#x1B[31mE   AssertionError: assert 'Missing required field' == 'Project does... organization'#x1B[0m
#x1B[1m#x1B[31mE     #x1B[0m
#x1B[1m#x1B[31mE     - Project does not belong to this organization#x1B[0m
#x1B[1m#x1B[31mE     + Missing required field#x1B[0m

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}