security: fix vulnerabilities and harden code (2026-03-12)

Path traversal fixes:
- DeleteFile.js: use path.resolve() + symlink protection (CRITICAL)
- DeleteFileFolder.js: add path.resolve() validation + symlink check (CRITICAL)
- RenameFile.js: use path.resolve() with proper prefix check + symlink guard (HIGH)
- attachments.js: add baseDir validation + skip symlinks in recursive search (MEDIUM)

XSS fixes:
- dashboard.js: escape user input in onerror/onclick inline attributes (HIGH)
- paramadminsettingsetup.script.js: escape values in innerHTML template (MEDIUM)

Input validation:
- inputValidationMiddleware.js: block suspicious requests instead of logging only (MEDIUM)

Version bump: 1.2.2-beta → 1.2.3-beta

routes/attachments.js

@@ -30,21 +30,37 @@ async function findFileInUserDir(userId, filename) {
     return findFileInDir(userDir, filename);
 }
 
-async function findFileInDir(dir, filename) {
+async function findFileInDir(dir, filename, baseDir) {
+    if (!baseDir) baseDir = dir;
+    const resolvedDir = path.resolve(dir);
+    const resolvedBase = path.resolve(baseDir);
+
+    if (resolvedDir !== resolvedBase && !resolvedDir.startsWith(resolvedBase + path.sep)) {
+        return null;
+    }
+
     let files;
     try {
         files = await fs.readdir(dir, { withFileTypes: true });
     } catch (err) {
-        return null; // Directory does not exist
+        return null;
     }
 
     for (const file of files) {
         const filePath = path.join(dir, file.name);
 
+        if (file.isSymbolicLink()) {
+            continue;
+        }
+
         if (file.name === filename && file.isFile()) {
-            return filePath;
+            const resolvedFile = path.resolve(filePath);
+            if (resolvedFile.startsWith(resolvedBase + path.sep)) {
+                return filePath;
+            }
+            return null;
         } else if (file.isDirectory()) {
-            const found = await findFileInDir(filePath, filename);
+            const found = await findFileInDir(filePath, filename, baseDir);
             if (found) {
                 return found;
             }