GHSA-j3m6-gvm8-mhvw No permission checks for editing/deleting records with CSV import form

• Packagist silverstripe/admin: >= 1.0.0, < 1.13.19 → fixed in 1.13.19 • Packagist silverstripe/admin: >= 2.0.0, < 2.1.8 → fixed in 2.1.8

Impact Users who don't have edit or delete permissions for records exposed in a `ModelAdmin` can still edit or delete records using the CSV import form, provided they have create permissions. The likelyhood of a user having create permissions but _not_ having edit or delete permissions is low, but it _is_ possible. Note that this doesn't affect any `ModelAdmin` which has had the import form disabled via the `showImportForm` public property, nor does it impact the `SecurityAdmin` section. Action may be required If you have a custom implementation of `BulkLoader`, you should update your implementation to respect permissions when the return value of `getCheckPermissions()` is true. If you are using any `BulkLoader` in your own project logic, or maintain a module which uses it, you should consider passing `true` to `setCheckPermissions()` if the data is provided by users. Base CVSS: 4.3 Reported by: Guy Sartorelli from Silverstripe References • https://www.silverstripe.org/download/security-releases/CVE-2023-49783