Unsafe plugins can be installed via pack import by tenant admins

Summary Unsafe plugins for instance sql-list can be installed in subdomain tenants via pack import even if unsafe plugin installation for tenants is disables Details I have an example https://bot20230704.saltcorn.com/view/allplugins It's publicly accessible but has not so secure values except lis...

GHSA-WXF3-4FVJ-VQQX Unsafe plugins can be installed via pack import by tenant admins

Summary Unsafe plugins for instance sql-list can be installed in subdomain tenants via pack import even if unsafe plugin installation for tenants is disables Details I have an example https://bot20230704.saltcorn.com/view/allplugins It's publicly accessible but has not so secure values except lis...