security: fix vulnerabilities and update security hardening (2026-03-12)

Code security fixes:
- Fixed 3 critical auth bypass bugs (user.jso, typo → user.json) in RenameFile, NewFolder, DeleteFolder API routes
- Added URL validation (HTTP/HTTPS only) on ProfilPicture and BackgroundCustom endpoints to prevent stored XSS/CSS injection
- Added path traversal protection in Upload.js (resolved path boundary check)
- Removed unsafe-eval from CSP script-src directive
- Removed information disclosure in BuildMetaData error responses
- Removed unused child_process import in BuildMetaData.js

Version bump: 1.2.1-beta → 1.2.2-beta

routes/Dpanel/API/Upload.js

@@ -68,6 +68,14 @@ router.post('/', (req, res) => {
         const filename = fields.filename ? fields.filename[0] : file.originalFilename;
         const filePath = path.join(userDir, filename);
 
+        // Path traversal protection: ensure resolved path stays within user directory
+        const resolvedUserDir = path.resolve(process.cwd(), 'cdn-files', userName);
+        const resolvedFilePath = path.resolve(filePath);
+        if (!resolvedFilePath.startsWith(resolvedUserDir + path.sep) && resolvedFilePath !== resolvedUserDir) {
+            if (fs.existsSync(file.path)) fs.unlinkSync(file.path);
+            return res.status(403).send('Path traversal detected');
+        }
+
         // Récupérer les champs supplémentaires
         const expiryDate = fields.expiryDate ? fields.expiryDate[0] : '';
         const password = fields.password ? fields.password[0] : '';