perhaps require that uploads only go into current dir? Strip all of file path? If they have a path, return bad request?
No dependencies set.
The note is not visible to the blocked user.
perhaps require that uploads only go into current dir? Strip all of file path? If they have a path, return bad request?