Ling12138-Sg

The '/de2api/datasetData/previewSql' endpoint lacks the mandatory `@DePermit` permission validation annotation. This allows any authenticated user to set the `datasourceId` variable to -1, granting unauthorized access to the built-in engine database to execute arbitrary SQL statements and read sensitive core data.

The template upload feature contains a path traversal issue, which occurs when an application uses user-supplied input to construct a pathname that is then used in a file operation. This allows authenticated administrators to execute arbitrary PHP code by uploading a malicious ZIP archive containing directory traversal sequences in filenames. This process enables the overwriting of default template files or the direct inclusion of malicious code files within the current template.