---
id: 16
title: Fix and secure cli_scripts/reset.php
status: done
priority: medium
created: 2026-07-17T03:57:35.272402311+02:00
updated: 2026-07-19T20:09:41.987393047+02:00
started: 2026-07-19T20:09:41.988806323+02:00
completed: 2026-07-19T20:09:41.988806323+02:00
tags:
    - cli
    - security
claimed_by: rain-raven
claimed_at: 2026-07-19T20:09:41.987393047+02:00
class: standard
---

From framework review (docs/framework_review.md), P1-4. cli_scripts/reset.php has multiple issues:
- Case mismatch: glob('./Sessions/*') vs actual 'sessions/' directory → no-op on case-sensitive FS
- No auth/CSRF: bare $_GET['allcollages'] == 'clear' triggers destructive unlink/rmdir
- If web-accessible it's an unauthenticated destructive endpoint
- Misplaced in cli_scripts/ (uses $_GET like a web script)
Fix: correct path, add CLI guard (php_sapi_name()), gate destructive branch behind confirmation.