Previous HEAD position was 67ac20568 [FIX] BASE: Prevent path traversal and directory access in protected_media.Use Django safe_join() for MEDIA_ROOT + path to block traversal. Serve only files (reject directories) via os.path.isfile() check
HEAD is now at b3bd29d15 Merge branch 'master' into 1.0
Resolved commit: b3bd29d15819cbece45c58e6268ddd0614e387d6