Fix icon hover colors, text alignment, and UI improvements

2026-02-25 23:25:59 +02:00
parent 00fda3e045
commit fcc4352afa
46 changed files with 4011 additions and 600 deletions
@@ -145,10 +145,19 @@ function deleteMediaInternal($id) {
    $item = $db->get('media', $id);
    
    if ($item) {
-        // Delete physical file
+        // Delete physical file with path traversal protection
        $filepath = __DIR__ . '/../' . $item['path'];
        if (file_exists($filepath)) {
-            unlink($filepath);
+            // Verify path is within uploads directory (prevent directory traversal)
+            $uploadDir = realpath(UPLOAD_DIR);
+            $filePath = realpath($filepath);
+            if ($filePath && $uploadDir && strpos($filePath, $uploadDir) === 0) {
+                if (!unlink($filepath)) {
+                    error_log('MSPE: Failed to delete file ' . $filepath);
+                }
+            } else {
+                error_log('MSPE: Path traversal attempt detected in deleteMedia');
+            }
        }
        $db->delete('media', $id);
        return true;