Fix thumb save location

[bobvandevijver]

Path calculation was broken after d007cf8. Instead, calculate the correct path earlier, and ensure path traversal is not possible.

[Copilot]

Pull request overview

This PR fixes the thumbnail save location path calculation, which was broken after commit d007cf8. The fix calculates the correct thumbnail path earlier in the process and ensures path traversal attacks are prevented through proper canonicalization.

Changes:

• Moved thumbnail path calculation to earlier in the thumbnail() method with proper canonicalization
• Updated saveAsFile() method signature to accept pre-calculated thumbnail path instead of calculating it internally
• Removed inline path construction in favor of the canonicalized path

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[clem]

Just needed to update the top of the class with this code for Bolt 6.0:

class ImageController
{
    private Server $server;

    /**
     * @var array{
     *     w?: int,
     *     h?: int,
     *     fit?: string,
     *     location?: string,
     *     q?: int
     * }
     */
    private array $parameters = [];

    private Request $request;

    public function __construct(
        private readonly Config $config
    ) {
    }

    #[Route(path: '/thumbs/{paramString}/{filename}', name: 'thumbnail', requirements: ['filename' => '.+'], methods: [Request::METHOD_GET])]
    public function thumbnail(Request $request, string $paramString, string $filename): Response
    {
        $this->request = $request;

        if (!$this->isImage($filename)) {
            return $this->sendErrorImage();
        }
        // ...

And thanks a lot because it works!