Jukka Lampikoski
45de863d07
Critical fixes: - company_logo_upload: validate user has access to target company - All delete functions (db.php): accept optional company_id parameter for defense-in-depth filtering (customers, devices, ipam, guides, leads, tickets, archives, mailboxes, rules, templates, todos) - All API delete calls now pass company_id to db layer - ticket_bulk_delete: per-ticket company_id filtering - todo_comment/time/subtask operations: verify todo belongs to company - dbGetMailbox: optional company_id scoping, used in smtp_test - requireCompanyOrParam: no longer mutates session permanently - Fix _dbFetch typo in zammad_attachment (was runtime error) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
