bug: BackupTable deletes archive file before confirming DB row deletion #76

New Issue

2026-06-21T23:01:24Z

jmiller commented

2026-06-21 23:01:24 +00:00

Severity: HIGH

BackupTable::delete() calls @unlink($this->absolute_path) before parent::delete($pk). If the DB delete fails, the archive file is permanently lost but the record still shows filesexist = 1.

Fix

Reverse the order — delete DB row first, then file:

$path = $this->absolute_path;
$result = parent::delete($pk);
if ($result && !empty($path) && is_file($path)) {
    @unlink($path);
}
return $result;

File

src/Table/BackupTable.php:42-47

## Severity: HIGH `BackupTable::delete()` calls `@unlink($this->absolute_path)` before `parent::delete($pk)`. If the DB delete fails, the archive file is permanently lost but the record still shows `filesexist = 1`. ## Fix Reverse the order — delete DB row first, then file: ```php $path = $this->absolute_path; $result = parent::delete($pk); if ($result && !empty($path) && is_file($path)) { @unlink($path); } return $result; ``` ## File - `src/Table/BackupTable.php:42-47`

jmiller added the component: engine label 2026-06-21 23:01:24 +00:00

jmiller referenced this issue

2026-06-21 23:04:13 +00:00

test: Deep dive audit — verify and fix all findings #81

jmiller referenced this issue from a commit

2026-06-21 23:09:43 +00:00

fix: critical and high audit findings (#81)

jmiller referenced a pull request that will close this issue

2026-06-21 23:09:56 +00:00

fix: Critical and high audit findings (#81) #83

jmiller closed this issue

2026-06-21 23:10:23 +00:00