## Fix Summary
The fix updates the API upload path to use the correct ThinkPHP 3.2+ extension whitelist property in `Api/AttachmentController::uploadImg()`. Specifically, it replaces deprecated `$upload->allowExts` with `$upload->exts`, ensuring the configured `jpg/gif/png/jpeg` allowlist is actually enforced by ThinkPHP upload handling. This closes the authenticated API bypass where `.phtml` files were accepted on fixed commit `e1cd02a`.

## Changes Made
- **File modified:** `server/Application/Api/Controller/AttachmentController.class.php`
  - In `uploadImg()`, changed:
    - ` $upload->allowExts = array('jpg','gif','png','jpeg');`
    - to ` $upload->exts = array('jpg','gif','png','jpeg');`
- **Patch artifact:** `coding/proposed_fix.diff`
- **Verification script:** `coding/verify_fix.sh`

## Verification Steps
1. Created a clean baseline and patched source tree from commit `e1cd02a3f98bb227c0599e7fa6b803ab1097597f`.
2. Applied `coding/proposed_fix.diff` to the patched tree using `patch -p1`.
3. Built Docker images (`php:7.4-apache`) for baseline and patched trees.
4. For each image, executed an end-to-end authenticated API upload flow:
   - initialize app (`install/non_interactive.php`)
   - seed one item row if needed
   - login via `POST /server/index.php?s=/Api/User/login`
   - attempt upload via `POST /server/index.php?s=/Api/Page/uploadImg` with `filename=verify_shell.phtml`
   - inspect `Public/Uploads` for `*.phtml`
5. Ran:
   - `chmod +x coding/verify_fix.sh && ./coding/verify_fix.sh`
   - Output: `[+] PASS: patch blocks .phtml upload on API endpoint while baseline remains vulnerable`

## Test Results
- **Baseline (unpatched e1cd):** `.phtml` upload succeeds (count > 0).
- **Patched:** `.phtml` upload blocked (count == 0).
- **Result:** vulnerability is resolved for the reproduced API bypass path.

Edge cases covered in verification flow:
- Real login/session-based authenticated API path (not mocked)
- Same exploit input on both baseline and patched targets for direct behavior comparison

## Remaining Concerns
- This patch is intentionally minimal and scoped to the validated bypass path (`Api/AttachmentController::uploadImg`).
- Additional hardening recommendation: centralize extension validation in a single shared helper/model method and apply consistently across all upload endpoints (including non-image attachment handlers), with explicit allowlists and server-side MIME/content checks.