* security: enforce tree access in api_tree node create/delete/rename (IDOR)
api_tree_create_node(), api_tree_delete_node() and api_tree_rename_node() checked only that tree_id was a positive number, so any authenticated user could create, delete, or rename nodes in another user's tree. Each now calls is_tree_allowed($tree_id) and refuses the operation for a tree the user may not access.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* chore: add the CHANGELOG entry
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
