security: fix vulnerabilities and update security hardening (2026-03-12)

Code security fixes:
- Fixed 3 critical auth bypass bugs (user.jso, typo → user.json) in RenameFile, NewFolder, DeleteFolder API routes
- Added URL validation (HTTP/HTTPS only) on ProfilPicture and BackgroundCustom endpoints to prevent stored XSS/CSS injection
- Added path traversal protection in Upload.js (resolved path boundary check)
- Removed unsafe-eval from CSP script-src directive
- Removed information disclosure in BuildMetaData error responses
- Removed unused child_process import in BuildMetaData.js

Version bump: 1.2.1-beta → 1.2.2-beta

routes/Dpanel/API/BackgroundCustom.js

@@ -13,6 +13,16 @@ router.post('/wallpaper', (req, res) => {
         return res.status(400).send('No wallpaper URL provided.');
     }
 
+    // Validate URL to prevent XSS/CSS injection via malicious URLs
+    try {
+        const parsed = new URL(wallpaperUrl);
+        if (!['http:', 'https:'].includes(parsed.protocol)) {
+            return res.status(400).send('Invalid URL protocol. Only HTTP/HTTPS allowed.');
+        }
+    } catch {
+        return res.status(400).send('Invalid URL format.');
+    }
+
     updateUserWallpaper(userId, wallpaperUrl, res);
 });