From e8e36156e9d2d953d9359fe33e80e94f233cd678 Mon Sep 17 00:00:00 2001
From: F4ilji <F4ilj@yandex.ru>
Date: Sun, 5 Jul 2026 03:01:12 +0500
Subject: [PATCH] fix(vikon): add file type validation and temp cleanup in
 UpdatePartAction

---
 .../Actions/UpdatePartAction.php              | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/app/Containers/VikonIntegration/Actions/UpdatePartAction.php b/app/Containers/VikonIntegration/Actions/UpdatePartAction.php
index c61124c..05e42ab 100644
--- a/app/Containers/VikonIntegration/Actions/UpdatePartAction.php
+++ b/app/Containers/VikonIntegration/Actions/UpdatePartAction.php
@@ -87,13 +87,22 @@ class UpdatePartAction
         $zip->close();
         File::delete($zipFile);
 
+        // Validate extracted file types
+        $blocked = $this->fs->validateFileTypes($tempPath);
+        if (!empty($blocked)) {
+            File::deleteDirectory($tempPath);
+            throw new \RuntimeException('Blocked files in ZIP: ' . implode(', ', $blocked));
+        }
+
         $modulePath = $this->basePath . '/' . $config['path'];
 
-        // Step 5: Apply
-        $syncedCount = $this->applyPart($part, $tempPath, $modulePath, $moduleId, $config);
-
-        // Step 6: Clean temp
-        File::deleteDirectory($tempPath);
+        try {
+            // Step 5: Apply
+            $syncedCount = $this->applyPart($part, $tempPath, $modulePath, $moduleId, $config);
+        } finally {
+            // Step 6: Clean temp (always runs, even on exception)
+            File::deleteDirectory($tempPath);
+        }
 
         Log::info('Vikon: part update complete', ['module' => $moduleId, 'part' => $part, 'synced' => $syncedCount]);