Joel Brock
df471e0e88
/api/submit wrote whatever {id} the client sent into file custom fields.
A link holder could point their org at any civicrm_file id, learn its
filename via /api/report, and make the staff file proxy treat it as
theirs. Each file id must now either be anchored to the submitting
contact (how /api/upload stores uploads) or equal the org's current value
for that field; otherwise the submit is rejected with a 400.