John Cardinal 705a54f9d8 case 4718 - report and translation import need create rights ...

report/upload and translation/upload had no role check, so any login, customer
contacts included, could import a report template (whose JavaScript runs in the
server's browser at render time) or a translation (security review F19, F24).
Both now require the same right as creating one, checked before the upload is
read. The import screens are already limited to those roles.

Checked locally: customer contact and Service 403, BizAdmin 202.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-24 12:10:00 -07:00

20 KiB

Raw Blame History

View Raw