Matthieu 2ac815d074 fix(security) : block SVG upload, enforce ROLE_CLIENT restrictions on documents ...

- Block SVG MIME type in TaskDocumentProcessor upload validation
- Serve existing SVG files as attachment (defense-in-depth) in download controller
- Block ROLE_CLIENT from uploading documents to tasks (only allowed via portal tickets)
- Add Doctrine extension to filter projects by allowedProjects for ROLE_CLIENT

Tickets: T-003, T-005, T-006

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-17 15:27:16 +01:00

2.1 KiB

Raw Blame History

View Raw