Kailash Nadh 4b805f885b Fix broken subscribers:sql_query permission. ... This permission was never checked for and had an unintended consequence of allowing a non-superadmin user to execute arbitrary queries (expected), but getting a superadmin session by joining the `sessions` table. This patch: - Introduces a table allowlist that uses the Postgres query plan (JSON) and validate the referenced tables against the allowed ones on arbitrary queries issued to the various `/subscribers` APIs. - Explicitly adds the missing `subscribers:sql_query` permission check to all handlers that accept `query`. - Introduces a new `search` parameter on all handlers that accept `query`. This parameter is an interface over the default name/email substring search instead of relying on `query`.		2025-04-18 14:15:47 +05:30
..
models.go	Turn notifs into a special stateful global singleton package, removing clunky deps.	2025-04-05 22:45:19 +05:30
queries.go	Fix broken subscribers:sql_query permission.	2025-04-18 14:15:47 +05:30
settings.go	Add support for domain allowlists in addition to blocklists. Closes #2230.	2025-03-29 23:31:34 +05:30