Promote the 2026-08-30 review security fixes and supplies ordering to main

plugins/computers/plugin.py

@@ -2013,3 +2013,20 @@ class ComputersPlugin(BasePlugin):
             ('computers.edit', 'Edit computers', 'computers'),
             ('computers.delete', 'Delete computers', 'computers'),
         ]
+
+    def get_guest_grantable_permissions(self) -> List[str]:
+        """Declared because a site chose it: the floor looks PCs up by number.
+
+        KNOWN GAP, tracked separately. The computer serializer is
+        BaseModel.to_dict(), so it publishes every column - serialnumber, the
+        Azure device and object ids - and the detail route resolves
+        accessmethods into working rdp:// and vnc:// links plus the full
+        Communication row. A guest granted this gets all of it, on the LIST
+        route as well, so it is one request rather than one per asset.
+
+        The fix is a field allowlist on Computer.to_dict() plus suppressing the
+        resolved links unless the caller holds a remote-access permission. Do
+        not widen this hook until that lands; a site enabling guest access
+        today should weigh it.
+        """
+        return ['computers.view']