tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Serve stored images safely and drop committed uploads.

Browse Source 
display.php takes the type from the image data, refuses anything else,
and sends nosniff. Remove the nine uploads in graphics/tmp.
This commit is contained in:
tim
2026-09-25 21:48:17 +02:00
parent c5ce7661f5
commit 1698680e24
11 changed files with 16 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+3
View File
@@ -1,2 +1,5 @@
# Local configuration and secrets (see .env.example)
.env
# Old upload directory; uploads now go to UPLOAD_DIR outside the web root
graphics/tmp/