From 16ed60a5c358a50cb3fd9ec606752efda8765156 Mon Sep 17 00:00:00 2001 From: Damodar Lohani Date: Sun, 5 Apr 2026 02:02:09 +0000 Subject: [PATCH] Filter unconfirmed members when transferring team ownership Prevent unconfirmed (pending invite) members from being promoted to owner or set as the team's primary user during membership/account deletion by adding a Query::equal('confirm', [true]) filter to the relevant findOne queries. Co-Authored-By: Claude Opus 4.6 (1M context) --- app/controllers/api/account.php | 1 + src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php | 1 + src/Appwrite/Platform/Workers/Deletes.php | 1 + 3 files changed, 3 insertions(+) diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php index 6ac6373c87..83fc7465c9 100644 --- a/app/controllers/api/account.php +++ b/app/controllers/api/account.php @@ -667,6 +667,7 @@ Http::delete('/v1/account') $nextMember = $dbForProject->findOne('memberships', [ Query::equal('teamInternalId', [$team->getSequence()]), Query::notEqual('userInternalId', $user->getSequence()), + Query::equal('confirm', [true]), ]); if (!$nextMember->isEmpty()) { diff --git a/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php b/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php index 3b516c2d60..d055ecb23f 100644 --- a/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php +++ b/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php @@ -126,6 +126,7 @@ class Delete extends Action if ($team->getAttribute('userInternalId') === $membership->getAttribute('userInternalId')) { $membership = $dbForProject->findOne('memberships', [ Query::equal('teamInternalId', [$team->getSequence()]), + Query::equal('confirm', [true]), ]); if (!$membership->isEmpty()) { diff --git a/src/Appwrite/Platform/Workers/Deletes.php b/src/Appwrite/Platform/Workers/Deletes.php index 9508f784bd..a138f7c93b 100644 --- a/src/Appwrite/Platform/Workers/Deletes.php +++ b/src/Appwrite/Platform/Workers/Deletes.php @@ -856,6 +856,7 @@ class Deletes extends Action if ($team->getAttribute('userInternalId') === $userInternalId) { $nextMembership = $dbForProject->findOne('memberships', [ Query::equal('teamInternalId', [$team->getSequence()]), + Query::equal('confirm', [true]), ]); if ($nextMembership !== false && !$nextMembership->isEmpty()) {