SiYuan: Missing Consistency Check Between PackageName And RepoURL/repoHash In Bazaar Package Install Allows Overwriting

Summary "installBazaarPlugin" and the equivalent endpoints for widgets/icons/templates/themes accept "packageName", "repoURL", and "repoHash" as independent request fields with no validation that they refer to the same package. "packageName" alone determines the install destination;...