diff --git a/src/sentry/api/endpoints/prompts_activity.py b/src/sentry/api/endpoints/prompts_activity.py index 963883f5610972..29f21e5f4f2974 100644 --- a/src/sentry/api/endpoints/prompts_activity.py +++ b/src/sentry/api/endpoints/prompts_activity.py @@ -92,8 +92,12 @@ def put(self, request: Request, **kwargs): # if project_id or organization_id in required fields make sure they exist # if NOT in required fields, insert dummy value so dups aren't recorded if "project_id" in required_fields: - if not Project.objects.filter(id=fields["project_id"]).exists(): - return Response({"detail": "Project no longer exists"}, status=400) + if not Project.objects.filter( + id=fields["project_id"], organization_id=request.organization.id + ).exists(): + return Response( + {"detail": "Project does not belong to this organization"}, status=400 + ) else: fields["project_id"] = 0 diff --git a/tests/sentry/api/endpoints/test_prompts_activity.py b/tests/sentry/api/endpoints/test_prompts_activity.py index 7d2d3b2c279150..21c0fe0b49a67c 100644 --- a/tests/sentry/api/endpoints/test_prompts_activity.py +++ b/tests/sentry/api/endpoints/test_prompts_activity.py @@ -81,18 +81,20 @@ def test_invalid_project(self) -> None: } resp = self.client.get(self.path, data) assert resp.status_code == 200 + project_id = self.project.id self.project.delete() # project doesn't exist resp = self.client.put( self.path, { "organization_id": self.org.id, - "project_id": self.project.id, + "project_id": project_id, "feature": "releases", "status": "dismissed", }, ) assert resp.status_code == 400 + assert resp.data["detail"] == "Project does not belong to this organization" def test_dismiss(self) -> None: data = { @@ -271,3 +273,20 @@ def test_batched(self) -> None: assert resp.status_code == 200 assert "dismissed_ts" in resp.data["features"]["releases"] assert "snoozed_ts" in resp.data["features"]["alert_stream"] + + def test_project_from_different_organization(self) -> None: + other_org = self.create_organization() + other_project = self.create_project(organization=other_org) + + resp = self.client.put( + self.path, + { + "organization_id": self.org.id, + "project_id": other_project.id, + "feature": "releases", + "status": "dismissed", + }, + ) + + assert resp.status_code == 400 + assert resp.data["detail"] == "Project does not belong to this organization"