Fix file access, XSS and access-control bugs from a security scan

- Media rows can no longer be created through the CRUD API, updates only
  take description fields on the caller's own row, and every media read
  or delete goes through mediaFilePath, which refuses paths outside
  DATA_DIR or inside the database folder.
- Uploads strip the file name and extension to safe characters and keep
  only title, description and summary from the request's media object.
- Folder imports no longer follow symlinks (walkRegularFiles), and the
  source path is quoted in the computer's shell.
- User and bot files are served with nosniff, and HTML, SVG, XML and
  scripts are sandboxed by CSP.
- Sandbox cookies are kept to the computer's prefix, and websocket
  upgrades on /ws and the computer proxy must come from the app's own
  address (README and Help note nginx's Host header).
- user_types CRUD writes go through the assignment matrix; members only
  read their own user record; read-only users can read CRUD again;
  grabUsers builds valid SQL for array search terms and bad pages; an
  admin media DELETE needs an id; read-only users can't delete media.
- Rate limits and the audit log use the connection's address, trusting
  forwarded headers only from a proxy, and login limits are split per
  address, per account from that address and per account overall.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/pages/api/auth/password-login.ts

@@ -3,7 +3,7 @@ import verifyUserPassword from "@/src/functions/backend/auth/verify-user-passwor
 import loginUser from "@/src/functions/backend/auth/login-user";
 import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
 import { AppData } from "@/src/data/app-data";
-import rateLimit from "@/src/utils/rate-limit";
+import rateLimit, { resetRateLimit } from "@/src/utils/rate-limit";
 import { PasswordLoginRequestSchema } from "@/src/schemas/auth-schema";
 import parseWithSchema from "@/src/utils/parse-with-schema";
 import safeErrorMessage from "@/src/utils/safe-error-message";
@@ -31,19 +31,26 @@ export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
 
         const window_ms = AppData["RateLimitWindowMinutes"] * 60 * 1000;
 
-        const ip_limit = rateLimit({
-            key: `password-login:ip:${grabRequestIP(req) || "unknown"}`,
-            limit: AppData["PasswordAttemptLimit"] * 4,
-            window_ms,
-        });
+        const ip = grabRequestIP(req) || "unknown";
+        const id_key = identifier.toLowerCase();
 
-        const identifier_limit = rateLimit({
-            key: `password-login:id:${identifier.toLowerCase()}`,
-            limit: AppData["PasswordAttemptLimit"],
-            window_ms,
-        });
+        /**
+         * Three buckets: one per address, one per account from that
+         * address (the tight one), and one per account from anywhere,
+         * looser, so guessing from many addresses is still bounded while
+         * a stranger can't lock the owner out with a handful of tries.
+         */
+        const limits = [
+            { key: `password-login:ip:${ip}`, limit: AppData["PasswordAttemptLimit"] * 4 },
+            { key: `password-login:id-ip:${id_key}:${ip}`, limit: AppData["PasswordAttemptLimit"] },
+            { key: `password-login:id:${id_key}`, limit: AppData["PasswordAttemptLimit"] * 10 },
+        ];
 
-        if (!ip_limit.allowed || !identifier_limit.allowed) {
+        const allowed = limits
+            .map(({ key, limit }) => rateLimit({ key, limit, window_ms }).allowed)
+            .every(Boolean);
+
+        if (!allowed) {
             throw new AppError(`Too many attempts. Please try again later.`);
         }
 
@@ -71,6 +78,8 @@ export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
             };
         }
 
+        resetRateLimit({ key: `password-login:id-ip:${id_key}:${ip}` });
+
         return await loginUser({
             user_id: target_user.id,
             req,