..  _safety:

=============
Safety design
=============

*   **Path traversal guards** on every file operation: physical paths are
    resolved with ``realpath()`` and checked against the real storage base
    before any rename, unlink or read.
*   **Type-to-confirm** on :guilabel:`Delete all filtered` in File Cleanup: the
    exact file count must be typed before it submits.
*   **ZIP backup download** before deleting, in File Cleanup.
*   **Re-validation before flush**: queued or scheduled flush runs re-check
    that the file still exists and is still safe to touch immediately before
    acting.
*   **Server-side deep check before every duplicate delete**: the delete
    endpoint re-runs the full usage search and refuses when anything is found;
    admin only, POST only.
*   **Resize safeguards**: dry run first, checks repeated on the real file at
    resize time, result discarded unless it saves at least 10 KB. No backup of
    the original (see :ref:`usage-oversized`).
*   **Disk over database**: duplicate report, oversized report and widgets
    check every file on disk and read sizes from disk instead of trusting
    :sql:`sys_file.missing` / :sql:`sys_file.size`.
*   **XSS-safe rendering**: record titles and other user data from AJAX results
    are inserted with ``textContent`` only.
*   **Self-healing scans**: if a stale DB flag no longer matches reality (a
    "missing" file is present again), the flag is corrected and the stale
    candidate dropped.