Security: IDOR on all update/delete endpoints — missing resource ownership checks

[lighthousekeeper1212]

Summary

All update/delete endpoints verify role permissions but never check resource ownership. Any user with updateProduct/updateOrder permission can modify ANY user's resources.

Key Findings (12 total, MEDIUM severity)

1. Orders::update/printDiv — modify/view any order without ownership check
2. Products::update — modify any product
3. Users::edit/delete — edit/delete any user account
4. Users::setting — privilege escalation via POST group parameter
5. Category/Stores/Attributes::update — modify any record
6. Unprotected AJAX endpoints (getProductValueById, fetchProductData)

Root Cause

Controllers check in_array('updateResource', $this->permission) but never validate the resource belongs to the current user. All model queries use the URL-supplied ID directly.

Fix

Add ownership check after permission check: verify $resource['user_id'] == $current_user before allowing modifications.