File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the signupHandler in File Browser applies default user permissions via d.settings.Defaults.Apply(user), then strips only Admin. The Execute permission and Commands list from the default user template are not stripped. When an administrator has enabled signup, server-side execution, and set Execute=true in the default user template, any unauthenticated user who self-registers inherits shell execution capabilities and can run arbitrary commands on the server. This issue has been patched in version 2.62.2.

Affected: Go: github.com/filebrowser/filebrowser/v2

## Summary

The `signupHandler` in File Browser applies default user permissions via `d.settings.Defaults.Apply(user)`, then strips only `Admin` (commit `a63573b`). The `Execute` permission and `Commands` list from the default user template are **not** stripped. When an administrator has enabled signup, server-side execution, and set `Execute=true` in the default user template, any unauthenticated user who self-registers inherits shell execution capabilities and can run arbitrary commands on the server.

## Details

### Root Cause

`signupHandler` at `http/auth.go:167–172` applies all default permissions before stripping only `Admin`:

```go // http/auth.go d.settings.Defaults.Apply(user) // copies ALL permissions from defaults

// Only Admin is stripped — Execute, Commands are still inherited user.Perm.Admin = false // user.Perm.Execute remains true if set in defaults // user.Commands remains populated if set in defaults ```

`settings/defaults.go:31–33` confirms `Apply` copies the full permissions struct including Execute and Commands:

```go func (d *UserDefaults) Apply(u *users.User) { u.Perm = d.Perm // includes Execute u.Commands = d.Commands // includes allowed shell commands // ... } ```

The `commandsHandler` at `http/commands.go:63–66` checks both the server-wide `EnableExec` flag and `d.user.Perm.Execute`:

```go if !d.server.EnableExec || !d.user.Perm.Execute { // writes "Command not allowed." and returns } ```

The `withUser` middlewa…