• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

This PR changes the usages of path::clean to path::check in the template manager. The key difference is, that path::check disallows relative paths and thereby prevents path traversals.

This is not supposed to be a security fix: the template manager is limited to super admins only and by definition allows code editing and therefore code execution. However, the JSST gets reports to those missing traversal checks over and over (AI huh, what a time to be alive) and tbh I'm not willing to waste any further resources replying to those reports. So let's convert clean to check.

Testing Instructions

Verify that the template manager file actions (edit, save, rename, delete, extract zip) work as before hand

Actual result BEFORE applying this Pull Request

Works

Expected result AFTER applying this Pull Request

Works

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed