Security context

Highlights

Auth Bypass: 10 prior fixes. Scrutinize any change in this area.

API.php: most-fixed (12 issues). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Multiple fixes show missing or incorrect capability checks for container version operations, especially around custom templates and publish-live permissions. The pattern of replacing existence checks with permission checks and adding capability checks across many methods indicates systemic gaps in authorization enforcement.

Auth Bypass: Controller methods had inconsistent access checks, some overly permissive (copyTag using write instead of custom-template capability) and some overly restrictive (copyContainer requiring superuser). This inconsistency creates confusion and potential privilege escalation paths.

Reflected XSS: The changeDebugUrl endpoint accepted arbitrary URLs and set a debug cookie without proper validation or permission checks, enabling reflected XSS. Fixes added URL validation and permission checks, but the initial gap shows a dangerous combination of missing input validation and authorization.