security: fix vulnerabilities and harden code (2026-03-12)

Path traversal fixes:
- DeleteFile.js: use path.resolve() + symlink protection (CRITICAL)
- DeleteFileFolder.js: add path.resolve() validation + symlink check (CRITICAL)
- RenameFile.js: use path.resolve() with proper prefix check + symlink guard (HIGH)
- attachments.js: add baseDir validation + skip symlinks in recursive search (MEDIUM)

XSS fixes:
- dashboard.js: escape user input in onerror/onclick inline attributes (HIGH)
- paramadminsettingsetup.script.js: escape values in innerHTML template (MEDIUM)

Input validation:
- inputValidationMiddleware.js: block suspicious requests instead of logging only (MEDIUM)

Version bump: 1.2.2-beta → 1.2.3-beta

routes/Dpanel/API/DeleteFile.js

@@ -156,19 +156,30 @@ router.post('/', authenticateToken, (req, res) => {
         return res.status(400).json({ message: 'User ID or filename missing for file deletion.' });
     }
 
-    const userFolderPath = path.join('cdn-files', userId);
+    const userFolderPath = path.resolve('cdn-files', userId);
 
     function findAndDeleteFile(folderPath) {
+        const resolvedFolder = path.resolve(folderPath);
+        if (!resolvedFolder.startsWith(userFolderPath + path.sep) && resolvedFolder !== userFolderPath) {
+            return false;
+        }
+
         const filesInFolder = fs.readdirSync(folderPath);
 
         for (const file of filesInFolder) {
             const filePath = path.join(folderPath, file);
+            const resolvedFilePath = path.resolve(filePath);
 
-            if (!filePath.startsWith(userFolderPath)) {
+            if (!resolvedFilePath.startsWith(userFolderPath + path.sep)) {
                 return false;
             }
 
-            if (fs.statSync(filePath).isDirectory()) {
+            const stat = fs.lstatSync(filePath);
+            if (stat.isSymbolicLink()) {
+                continue;
+            }
+
+            if (stat.isDirectory()) {
                 const fileDeletedInSubfolder = findAndDeleteFile(filePath);
                 if (fileDeletedInSubfolder) {
                     return true;