fix: #3634862 Refuse a file directory that leaves the files folder

Rajab Natshahrequested to merge
issue/ai_media-3634862:3634862-file-directory into 1.0.x

Issue: https://www.drupal.org/project/ai_media/issues/3634862

validateDirectory() trimmed slashes only, so "../x" was stored and files would go to public://../x. The form now refuses "." and ".." segments and a scheme, with a field error. At save time, a folder that resolves to a "." or ".." segment after token replacement falls back to the field's folder, then the upload root. Each fallback logs a fixed notice.

Before: a file directory of ../x is saved.

Before

After: ../x is refused with a field error.

After

AI-Generated: Yes

Checkpoints:

  • File an issue
  • Addition/Change/Update/Fix
  • Testing to ensure no regression
  • Automated unit testing coverage
  • Automated functional testing coverage
  • UX/UI designer responsibilities
  • Readability
  • Accessibility
  • Performance
  • Security
  • Developer Documentation
  • User Guide Documentation
  • Reviewed by human
  • Code review by maintainers
  • Full testing and approval
  • Credit contributors
  • Review with the product owner
  • Release notes snippet
  • Release

🤖 Generated with Claude Code

Edited by Rajab Natshah

Merge request reports