article
New delete button hands the server a path, and the server doesn't take its word for it
A Delete button was added to the backup page in the scheduling app. It sends a file path, so the server resolves it, fences it to the selected company's folder with a separator-aware check, refuses anything but a regular file, and only then deletes. What still bugs me: name-derived folders, hard deletes, no password, no tests and a vague audit entry.
Read more 3m read