fix(media): Allow deleting files outside upload_files

[Ibochkarev]

What changed and why

removeObject() called checkFileType() before delete(). When the media source property allowedFileTypes is empty, that method uses the system setting upload_files. The default list has no log, so deleting core/cache/logs/error.log failed with file_err_ext_not_allowed.

#15643 (SEC-3837) added the check so the manager cannot write a disallowed extension. The setting text in core/lexicon/en/setting.inc.php describes uploads. Delete does not write a new extension. Browser/File/Remove already requires the file_remove permission and the source remove policy.

The call is gone from removeObject(). createObject(), updateObject(), uploadObjectsToContainer(), and the new name in renameObject() still use checkFileType().

How to test

With allowedFileTypes empty on the Filesystem source, delete core/cache/logs/error.log from the file browser. It should be removed.

Upload or create a file whose extension is not in upload_files. That should still fail with file_err_ext_not_allowed. Renaming a file to a disallowed extension should fail the same way.

Related issue(s)/PR(s)

Resolves #15905

The check comes from #15643.

Compatibility notes

This applies to every media source that uses modMediaSource::removeObject(). There is no schema change and no upgrade script.

Breaking change assessment

No public API signature change. A user who already has file_remove can now delete a file whose extension is outside upload_files. Writing that extension is still rejected.

Test coverage

No test added. _build/test has no media source coverage for removeObject(), and there is no local properties.inc.php to run PHPUnit against a filesystem source.

Contributors

@Jako reported that error.log cannot be deleted and pointed at #15643.

AI tool use

Cursor compared removeObject() with the checks added in #15643 and removed the extension check from delete only.