fix(controller): validate trigger task ownership

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

cmd/dashboard/controller/alertrule.go

@@ -2,6 +2,7 @@ package controller
 
 import (
 	"maps"
+	"slices"
 	"strconv"
 	"time"
 
@@ -192,5 +193,15 @@ func validateRule(c *gin.Context, r *model.AlertRule) error {
 	} else {
 		return singleton.Localizer.ErrorT("need to configure at least a single rule")
 	}
+
+	// Trigger task IDs are user-controlled; validate them here so alerts cannot
+	// reference another user's cron and later execute it from the sentinel path.
+	if !singleton.CronShared.CheckPermission(c, slices.Values(r.FailTriggerTasks)) {
+		return singleton.Localizer.ErrorT("permission denied")
+	}
+	if !singleton.CronShared.CheckPermission(c, slices.Values(r.RecoverTriggerTasks)) {
+		return singleton.Localizer.ErrorT("permission denied")
+	}
+
 	return nil
 }