2 Commits

Author	SHA1	Message	Date
paul	4e977f7624	fix(security): allow serving static files from uploads directory ... - Remove overly restrictive absolute path check in isPathSafe - Strip leading slash from request path before validation - Fixes broken favicon and watermark image previews in branding page - Path traversal protection remains intact with ../ pattern checks 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-13 19:43:29 +02:00
paul	66841e8af7	fix(security): implement file upload security enhancements ... - Add path traversal protection with secureStatic middleware - Implement proper MIME type validation for all file uploads - Add content-based file validation (magic numbers) - Create comprehensive fileSecurityUtils for secure file operations - Update adminPhotos.js with enhanced validation - Update adminSettings.js for secure logo/favicon uploads - Addresses file upload vulnerabilities from security scan 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-13 19:30:17 +02:00