fix: the backend link show and confirm POSTs ignore a code in the query string

readFields falls back to r.Form, which includes the query string, so
POST /backend-link/show?code=... and /confirm?code=... worked and put the
code into access logs. Both routes now read the code from the body only
(JSON or a form body).

controllers/api_controller.go

@@ -1165,6 +1165,26 @@ func activationLink(app *backpack.App, id uint, code string) string {
 	return base + "?" + q.Encode()
 }
 
+// readBodyFields is readFields without the query string: a JSON body, or a
+// form-encoded body read from r.PostForm. The routes that carry a secret in
+// a field use it, so the secret is never taken from a URL that access logs
+// record.
+func readBodyFields(r *http.Request) (map[string]any, error) {
+	if strings.Contains(r.Header.Get("Content-Type"), "application/json") {
+		return readFields(r)
+	}
+	if err := r.ParseForm(); err != nil {
+		return nil, err
+	}
+	fields := map[string]any{}
+	for k, v := range r.PostForm {
+		if len(v) > 0 {
+			fields[k] = v[0]
+		}
+	}
+	return fields, nil
+}
+
 func readFields(r *http.Request) (map[string]any, error) {
 	ct := r.Header.Get("Content-Type")
 	if strings.Contains(ct, "application/json") {