From ddaac523bfb109cebaf0d535af7bea679b3942cd Mon Sep 17 00:00:00 2001
From: John Mizerek <mizerek@gmail.com>
Date: Fri, 13 Feb 2026 07:40:10 -0800
Subject: [PATCH] Add auto-cleanup of old temp extractions (>1 hour)

Security: Also added nginx rule on dev server to block CFM/PHP
execution in /temp/menu-import/ directory.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 api/setup/uploadSavedPage.cfm | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/api/setup/uploadSavedPage.cfm b/api/setup/uploadSavedPage.cfm
index 32ddeb3..23f1fb0 100644
--- a/api/setup/uploadSavedPage.cfm
+++ b/api/setup/uploadSavedPage.cfm
@@ -17,6 +17,21 @@
         <cfdirectory action="create" directory="#tempBaseDir#" mode="755">
     </cfif>
 
+    <!--- Cleanup: delete folders older than 1 hour --->
+    <cftry>
+        <cfdirectory action="list" directory="#tempBaseDir#" name="oldFolders" type="dir">
+        <cfset oneHourAgo = dateAdd("h", -1, now())>
+        <cfloop query="oldFolders">
+            <cfif oldFolders.dateLastModified LT oneHourAgo AND oldFolders.name NEQ "." AND oldFolders.name NEQ "..">
+                <cftry>
+                    <cfdirectory action="delete" directory="#tempBaseDir#/#oldFolders.name#" recurse="true">
+                <cfcatch></cfcatch>
+                </cftry>
+            </cfif>
+        </cfloop>
+    <cfcatch></cfcatch>
+    </cftry>
+
     <!--- Check if ZIP file was uploaded --->
     <cfif NOT structKeyExists(form, "zipFile") OR form.zipFile EQ "">
         <cfset response["MESSAGE"] = "No ZIP file uploaded">