Hongming Wang 7c9192063d fix(security): #190 — gate POST /templates/import behind AdminAuth ... Closes #190 (HIGH). The route was registered on the root router with no auth middleware, letting any unauthenticated caller write arbitrary files into configsDir via a crafted template. Same vulnerability class as #164 (bundles/import) and path-traversal risk same as #103 (org/import). One-line gate via the existing wsAdmin pattern. Lazy-bootstrap fail-open preserved for fresh installs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-04-15 11:00:49 -07:00
..
router.go	fix(security): #190 — gate POST /templates/import behind AdminAuth	2026-04-15 11:00:49 -07:00