bdebb42

fix(security): L-2/3/5/7 — int-bind chat LIMIT/OFFSET, hardcode public settings scope, gate ambiguous_candidates behind ratecard.manage, keep external_guest payout permission across migrations

2026-08-24T06:11:48+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

Files8

Core0

Module0

Forbidden0

Files

api/controller/setting/SettingController.php (api)
api/system/library/database/migration/ExternalUsersMigration.php (migration)
api/system/library/security/FinancialFieldPolicy.php (api)
api/system/library/service/ChatService.php (api)
api/controller/setting/SettingController.php (api)
api/system/library/database/migration/ExternalUsersMigration.php (migration)
api/system/library/security/FinancialFieldPolicy.php (api)
api/system/library/service/ChatService.php (api)