ZapMachine/kanban/tasks/016-fix-and-secure-cli-scripts-reset-php.md

id	title	status	priority	created	updated	started	completed	tags	claimed_by	claimed_at	class
16	Fix and secure cli_scripts/reset.php	done	medium	2026-07-17T03:57:35.272402311+02:00	2026-07-19T20:09:41.987393047+02:00	2026-07-19T20:09:41.988806323+02:00	2026-07-19T20:09:41.988806323+02:00	cli security	rain-raven	2026-07-19T20:09:41.987393047+02:00	standard

From framework review (docs/framework_review.md), P1-4. cli_scripts/reset.php has multiple issues:

• Case mismatch: glob('./Sessions/*') vs actual 'sessions/' directory → no-op on case-sensitive FS
• No auth/CSRF: bare $_GET['allcollages'] == 'clear' triggers destructive unlink/rmdir
• If web-accessible it's an unauthenticated destructive endpoint
• Misplaced in cli_scripts/ (uses $_GET like a web script) Fix: correct path, add CLI guard (php_sapi_name()), gate destructive branch behind confirmation.