Avoid Arbitrary File Deletion abuse via Object Injection

[mcdruid]

As discussed with @rhukster this simple change should avoid \Grav\Framework\Cache\Adapter\FileCache::__destruct being abused via Object Injection to achieve Arbitrary File Deletion.

I've used strpos rather than str_starts_with as it looks like Grav supports PHP 7.

[rhukster]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting

• @codex fix this CI failure
• @codex address that feedback

[chatgpt-codex-connector]

Sanitize temp-file prefix on Windows

The new temp filename uses uniqid(__CLASS__, true), but __CLASS__ contains backslashes. On Windows these are treated as path separators, so the prefix Grav\Framework\Cache\Adapter\FileCache... expands into nested directories under $this->directory that are never created. As soon as file_put_contents($this->tmp, $data) runs, cache writes will fail with "No such file or directory" and the cache backend becomes unusable on Windows installations. Consider stripping namespace separators or using a simple prefix like FileCache.

Useful? React with 👍 / 👎.