SUM-SEC-17 [P2][17/20][Low] App logs handler must enforce ORM model Access Control List (ACL)

[CHINMAYVIVEK]

ID: SUM-SEC-17
Wave: P2
Severity: Low
Labels: security, acl, admin, P2, low
Branch: fix/SUM-SEC-17-app-logs-orm-acl
Languages: Go

Summary

App logs UI uses raw SQL after a menu/group check only. If menu groups change, the handler can bypass CheckModelAccess for app.log.

Acceptance criteria

• Call CheckModelAccess(ctx, uid, "app.log", "read") (or equivalent) in handler
• Test denied when ACL missing even if route reached

Files to check / change

• sumeru/core/server/web/settings_app_logs.go (~L80–92)