GHSA-gfhq-7499-f3f2 TSPortal: Any user can forge self-deletion requests for any account

• Packagist miraheze/ts-portal: < 30 → fixed in 30

Summary Conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. Details Creating a DPA report about another user and leaving the evidence field empty causes that report to look like the reported user self-requested deletion of their data. Ingenuine report is not distinguishable from a genuine one. This can be prevented by disabling convertEmptyStringsToNull in the middleware, or by validating `evidence` in Http/Controllers/DPAController::store() to not be empty. PoC New DPA report -> Select "...someone who I suspect is under the age of 13" for the "The above username is..." field -> Add nothing to the "Evidence" field -> Submit Impact Potential unauthorized deletion of any arbitrary user's data both in the current system (TSPortal) and subsequent systems if actioned.