[Bug]: Unrestricted dynamic __import__ in ajax_autocomplete #5350
Description
Description
There is a critical vulnerability in esp/db/views.py where the ajax_autocomplete view accepted model_module and model_name directly from request.GET and passed them to import(). Any authenticated user could import and call methods on arbitrary Python modules on the server.
Steps to Reproduce
No response
Expected Behavior
No response
Actual Behavior
No response
Screenshots
No response
Operating System
No response
Browser
No response
Additional Context
No response