---
title: "Safety design"
manual: "Filefix"
version: "main"
permalink: "https://docs.typo3.org/permalink/anubit/filefix:safety@main"
source: "Safety/Index.rst"
rendered: "2026-10-16T12:43:55+00:00"
---

# Safety design {#safety}

-   **Path traversal guards** on every file operation: physical paths are
    resolved with `realpath()` and checked against the real storage base
    before any rename, unlink or read.
-   **Type-to-confirm** on **Delete all filtered** in File Cleanup: the
    exact file count must be typed before it submits.
-   **ZIP backup download** before deleting, in File Cleanup.
-   **Re-validation before flush**: queued or scheduled flush runs re-check
    that the file still exists and is still safe to touch immediately before
    acting.
-   **Server-side deep check before every duplicate delete**: the delete
    endpoint re-runs the full usage search and refuses when anything is found;
    admin only, POST only.
-   **Resize safeguards**: dry run first, checks repeated on the real file at
    resize time, result discarded unless it saves at least 10 KB. No backup of
    the original (see [Oversized images](https://docs.typo3.org/permalink/anubit/filefix:usage-oversized@main)).
-   **Disk over database**: duplicate report, oversized report and widgets
    check every file on disk and read sizes from disk instead of trusting
    `sys_file.missing` / `sys_file.size`.
-   **XSS-safe rendering**: record titles and other user data from AJAX results
    are inserted with `textContent` only.
-   **Self-healing scans**: if a stale DB flag no longer matches reality (a
    "missing" file is present again), the flag is corrected and the stale
    candidate dropped.