From fdfe87be38e4d642caf227787fec7d8a69a8944b Mon Sep 17 00:00:00 2001
From: Isaac Connor <isaac@zoneminder.com>
Date: Fri, 3 Oct 2025 16:10:32 -0400
Subject: [PATCH] Fixup deletePath.  Handle links, and report failures. Fix
 escaping the filename and put it in quotes in case it has spaces. Fixes #4446

---
 web/includes/functions.php | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/web/includes/functions.php b/web/includes/functions.php
index cdfa2d4a1..2f2a0f257 100644
--- a/web/includes/functions.php
+++ b/web/includes/functions.php
@@ -362,10 +362,16 @@ function getEventDefaultVideoPath($event) {
 
 function deletePath( $path ) {
   ZM\Debug('Deleting '.$path);
-  if (is_dir($path)) {
-    system(escapeshellcmd('rm -rf '.$path));
+  if (is_link($path)) {
+    if (!unlink($path)) ZM\Debug("Failed to unlink $path");
+  } else if (is_dir($path)) {
+    if (false === ($output = system('rm -rf "'.escapeshellcmd($path).'"'))) {
+      ZM\Warning('Failed doing rm -rf "'.escapeshellcmd($path).'"');
+    }
   } else if (file_exists($path)) {
-    unlink($path);
+    if (!unlink($path)) ZM\Debug("Failed to delete $path");
+  } else {
+    ZM\Warning("Path $path does not exist in deletePath()");
   }
 }