GHSA-F74M-X83R-C4V4 FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

Summary GET /batchdownload streams a batch ZIP to any requester who supplies its uniqid, without checking that the current user/session created it. In deployments where users have separate home directories, a valid low-privileged user who obtains an active archive id can download another user's...