Repository: getsentry/sentry

Issue:
User invite accept screen leaks 'project names' of projects that the new user does not necessarily have access rights to
<!--

Do you want to ask a question? Are you looking for support? The Sentry message
board is the best place for getting support: https://forum.sentry.io
-->

## Important Details

How are you running Sentry?

* [ ] On-Premise docker [Version xyz]
* [x] Saas (sentry.io)
* [ ] Other [briefly describe your environment]

## Description

We are providing sentry as a service with our products to our customer, as a result we have internal teams but would also like to invite external users (customers) to specific projects. We are able to utilise the team construct for this and setup special customer teams with limited access.

When we however invite customers into our org to become member of this restricted team the customer received a generic org invite email and is redirected to a generic org invite screen:
https://sentry.io/accept/xyz/xyz

This invite accept screen provides a list of 'active' projects with full project name, however the user does not necessary have access to these projects. 

We would classify this as a security concern and leak of 'restricted' information. 

## Steps to Reproduce

1. open org
2. create 2 new teams
    - team A
    - team B
2. create 2 new projects
    - project A, assign access to team A
    - project B, assign access to team B
3. invite new user to org (as member level) and assign acces to team B only
4. user receives invite by email and opens the accept link
5. on the accept webpage notice that both project A and B are listed to be part of this org

### What you expected to happen

The recommendation is to hide the project names completely in this view, or restrict it to the projects the new user has access to based on his team assignment.



Discussion:

Resolving patch:
diff --git a/src/sentry/web/frontend/accept_organization_invite.py b/src/sentry/web/frontend/accept_organization_invite.py
--- a/src/sentry/web/frontend/accept_organization_invite.py
+++ b/src/sentry/web/frontend/accept_organization_invite.py
@@ -6,7 +6,7 @@
 from django.utils.crypto import constant_time_compare
 from django.utils.translation import ugettext_lazy as _
 
-from sentry.models import AuditLogEntryEvent, Authenticator, OrganizationMember, Project
+from sentry.models import AuditLogEntryEvent, Authenticator, OrganizationMember
 from sentry.signals import member_joined
 from sentry.utils import auth
 from sentry.web.frontend.base import BaseView
@@ -56,16 +56,8 @@ def handle(self, request, member_id, token):
         om = helper.om
         organization = om.organization
 
-        qs = Project.objects.filter(
-            organization=organization,
-        )
-        project_list = list(qs[:25])
-        project_count = qs.count()
-
         context = {
             'org_name': organization.name,
-            'project_list': project_list,
-            'project_count': project_count,
             'needs_authentication': not helper.user_authenticated,
             'needs_2fa': helper.needs_2fa,
             'logout_url': u'{}?next={}'.format(


Test patch: