Correct privileges on group_plugin_action and bump to 4.8.5

sentry/web/decorators.py

@@ -133,10 +133,7 @@ def has_group_access(func):
 
     @wraps(func)
     def wrapped(request, project_id, group_id, *args, **kwargs):
-        group = get_object_or_404(Group, pk=group_id)
-
-        if group.project and project_id not in (group.project.slug, str(group.project.id)):
-            return HttpResponse(status=404)
+        group = get_object_or_404(Group, pk=group_id, project=project_id)
 
         if group.is_public:
             return func(request, group.project, group, *args, **kwargs)

sentry/web/frontend/groups.py

@@ -336,8 +336,9 @@ def group_event_details_json(request, project, group, event_id_or_latest):
 
 @login_required
 @has_access
-@has_group_access
-def group_plugin_action(request, project, group, slug):
+def group_plugin_action(request, project, group_id, slug):
+    group = get_object_or_404(Group, pk=group_id, project=project)
+
     try:
         plugin = plugins.get(slug)
     except KeyError:

setup.py

@@ -75,7 +75,7 @@ dependency_links = [
 
 setup(
     name='sentry',
-    version='4.8.4',
+    version='4.8.5',
     author='David Cramer',
     author_email='dcramer@gmail.com',
     url='http://github.com/dcramer/sentry',