From 2b0c3be0f58374071ab7d499aed775be094e4d49 Mon Sep 17 00:00:00 2001 From: michalsn Date: Thu, 18 Jun 2026 20:07:45 +0200 Subject: [PATCH] docs: warn against user-controlled image paths --- user_guide_src/source/libraries/images.rst | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/user_guide_src/source/libraries/images.rst b/user_guide_src/source/libraries/images.rst index 4696b0d126d4..2bffd2b9a122 100644 --- a/user_guide_src/source/libraries/images.rst +++ b/user_guide_src/source/libraries/images.rst @@ -42,6 +42,14 @@ The available Handlers are as follows: On Windows, the ImageMagick handler requires **absolute file paths** when loading images (for example, using ``WRITEPATH`` or ``FCPATH``). +.. warning:: + Do not let user input directly decide the image source path, storage + directory, or filename. This includes values passed to methods like + ``save()``, ``copy()`` and others, and any path or filename used to store + processed images. Use directories controlled by your application, and + generate filenames yourself or sanitize them with + :php:func:`sanitize_filename`. + ******************* Processing an Image *******************