Add Media manager (/admin/media), remove unused images/ scaffolding

Upload/browse/delete UI for files under public/uploads/, covered by the
existing /admin/* auth gate with no separate feature flag needed (no
SQLite dependency to gate). Extension allowlist and max upload size are
configurable; filenames are sanitized and de-duplicated on upload, and
deletes re-verify the resolved path lands inside the upload directory
before touching disk. Docker gains a fourth-turned-third named volume
for public/uploads/ so uploads survive a rebuild.

images/ (reserved scaffolding for a future image feature) is removed —
nothing ever consumed it, and public/uploads/ now covers that use case.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
code
2026-07-15 07:35:45 +00:00
parent 6624c4fdc3
commit a0ae58c29e
15 changed files with 459 additions and 542 deletions
+2 -2
View File
@@ -31,9 +31,9 @@ COPY public/ ./public/
COPY App/ ./App/
# Runtime-writable paths not covered by named volumes in docker-compose.yml.
RUN mkdir -p public/cache data images \
RUN mkdir -p public/cache public/uploads data \
&& touch novaconium/contact-log.txt \
&& chown -R http:http public/cache data images App novaconium/contact-log.txt
&& chown -R http:http public/cache public/uploads data App novaconium/contact-log.txt
EXPOSE 80