John Cardinal
e58ab2c100
report/download and export/download (any download key), the log-file routes and backup download built a path from the file name in the URL with Path.Combine and no check, so on Windows a name with a folder part or an absolute path could reach files outside the folder (security review F21). New helper FileUtil.FullPathInFolderOrNull accepts only a bare file name that resolves directly inside the folder; TemporaryFileExists and BackupFileExists use it (the download routes already call them first), and so do both log routes. A refused name gets the same 404 as a missing file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>