fix: Validate filename in _file_put_contents and update uploadPoster to use internal path for thumbnails

Author: Daniel Neto

objects/functionsFile.php

@@ -810,6 +810,10 @@ function getTmpFile()
 
 function _file_put_contents($filename, $data, $flags = 0, $context = null)
 {
+    if (!is_string($filename) || trim($filename) === '') {
+        _error_log("_file_put_contents: empty filename");
+        return false;
+    }
     make_path($filename);
     if (!is_string($data)) {
         $data = _json_encode($data);

plugin/Live/uploadPoster.json.php

@@ -44,8 +44,8 @@
         // SECURITY: Use internal path for file operations but don't expose to API
         $internalPathThumbs = $global['systemRootPath'] . Live::_getPosterThumbsImage(User::getId(), $live_servers_id, $posterType);
 
-        _error_log("removePoster.php ({$obj->pathThumbs}) unlink line=" . __LINE__);
-        @unlink($obj->pathThumbs);
+        _error_log("removePoster.php ({$internalPathThumbs}) unlink line=" . __LINE__);
+        @unlink($internalPathThumbs);
         $obj->error = false;
     }
 }
@@ -63,10 +63,9 @@
     }
 
     if (!empty($jsonTargetImagePath)) {
-        $obj->jsonFile = str_replace('.jpg', '.json', $jsonTargetImagePath);
-        $obj->jsonFileBytes = _file_put_contents($obj->jsonFile, $o);
+        $jsonFilePath = str_replace('.jpg', '.json', $jsonTargetImagePath);
+        $obj->jsonFileBytes = _file_put_contents($jsonFilePath, $o);
     } else {
-        $obj->jsonFile = '';
         $obj->jsonFileBytes = false;
     }
 }