validation, toast, modal, folder tree

getFolderList.php

@@ -9,17 +9,43 @@ if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
     exit;
 }
 
-$folderList = [];
-$dir = rtrim(UPLOAD_DIR, '/\\');
-if (is_dir($dir)) {
-    foreach (scandir($dir) as $item) {
+/**
+ * Recursively scan a directory for subfolders.
+ *
+ * @param string $dir The full path to the directory.
+ * @param string $relative The relative path from the base upload directory.
+ * @return array An array of folder paths (relative to the base).
+ */
+function getSubfolders($dir, $relative = '') {
+    $folders = [];
+    $items = scandir($dir);
+    // Allow letters, numbers, underscores, dashes, and spaces in folder names.
+    $safeFolderNamePattern = '/^[A-Za-z0-9_\- ]+$/';
+    foreach ($items as $item) {
         if ($item === '.' || $item === '..') continue;
+        // Only process folder names that match the safe pattern.
+        if (!preg_match($safeFolderNamePattern, $item)) {
+            continue;
+        }
         $path = $dir . DIRECTORY_SEPARATOR . $item;
         if (is_dir($path)) {
-            $folderList[] = $item;
+            // Build the relative path.
+            $folderPath = ($relative ? $relative . '/' : '') . $item;
+            $folders[] = $folderPath;
+            // Recursively get subfolders.
+            $subFolders = getSubfolders($path, $folderPath);
+            $folders = array_merge($folders, $subFolders);
         }
     }
+    return $folders;
+}
+
+$baseDir = rtrim(UPLOAD_DIR, '/\\');
+$folderList = [];
+
+if (is_dir($baseDir)) {
+    $folderList = getSubfolders($baseDir);
 }
 
 echo json_encode($folderList);
-?>
+?>