added unlink safeguard

2026-01-15 08:28:41 +10:00
parent 4eb3dfbb64
commit 8babb4c836
1 changed files with 8 additions and 1 deletions
--- a/app/Http/Controllers/MediaController.php
+++ b/app/Http/Controllers/MediaController.php
@@ -263,7 +263,14 @@ class MediaController extends Controller
            }
        }

-        unlink($file->getRealPath());
+        $tempPath = $file->getRealPath();
+        if(is_string($tempPath)) {
+            $realPath = realpath($tempPath);
+            $tempDir = realpath(sys_get_temp_dir());
+            if($realPath !== false && $tempDir !== false && str_starts_with($realPath, $tempDir . DIRECTORY_SEPARATOR)) {
+                @unlink($realPath);
+            }
+        }

        if($request->wantsJson()) {
            return response()->json([