fix(security): implement file upload security enhancements

- Add path traversal protection with secureStatic middleware
- Implement proper MIME type validation for all file uploads
- Add content-based file validation (magic numbers)
- Create comprehensive fileSecurityUtils for secure file operations
- Update adminPhotos.js with enhanced validation
- Update adminSettings.js for secure logo/favicon uploads
- Addresses file upload vulnerabilities from security scan

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

backend/src/routes/adminSettings.js

@@ -21,18 +21,19 @@ const storage = multer.diskStorage({
   }
 });
 
+const { validateFileType } = require('../utils/fileSecurityUtils');
+
 const upload = multer({
   storage,
   limits: { fileSize: 5 * 1024 * 1024 }, // 5MB
   fileFilter: (req, file, cb) => {
-    const allowedTypes = /jpeg|jpg|png|gif|svg/;
-    const extname = allowedTypes.test(path.extname(file.originalname).toLowerCase());
-    const mimetype = allowedTypes.test(file.mimetype);
+    // Note: SVG files are excluded from magic number validation for logos
+    const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/gif', 'image/svg+xml'];
     
-    if (mimetype && extname) {
+    if (validateFileType(file.originalname, file.mimetype, allowedMimeTypes)) {
       return cb(null, true);
     } else {
-      cb(new Error('Only image files are allowed'));
+      cb(new Error('Only JPEG, PNG, GIF and SVG image files are allowed'));
     }
   }
 });
@@ -54,8 +55,18 @@ const faviconUpload = multer({
   storage: faviconStorage,
   limits: { fileSize: 1 * 1024 * 1024 }, // 1MB
   fileFilter: (req, file, cb) => {
-    const allowedTypes = ['image/png', 'image/x-icon', 'image/vnd.microsoft.icon'];
-    if (allowedTypes.includes(file.mimetype)) {
+    const allowedMimeTypes = ['image/png', 'image/x-icon', 'image/vnd.microsoft.icon'];
+    
+    // For ICO files, we can't use the standard validateFileType
+    if (file.mimetype === 'image/png') {
+      if (validateFileType(file.originalname, file.mimetype, ['image/png'])) {
+        cb(null, true);
+      } else {
+        cb(new Error('Invalid PNG file'));
+      }
+    } else if (allowedMimeTypes.includes(file.mimetype) && 
+               (file.originalname.toLowerCase().endsWith('.ico') || 
+                file.originalname.toLowerCase().endsWith('.png'))) {
       cb(null, true);
     } else {
       cb(new Error('Favicon must be PNG or ICO format'));