Fix Snyk security findings: XSS, open redirect, hardcoded secrets, cookie security, MD5 replacement

src/components/admin/media-grid.tsx

@@ -6,12 +6,9 @@ import { uploadMedia } from "@/actions/admin-media";
 type MediaFile = { name: string; url: string };
 
 function validImageUrl(url: string): string {
-  try {
-    const u = new URL(url, window.location.origin);
-    return u.protocol === "http:" || u.protocol === "https:" ? u.href : "";
-  } catch {
-    return "";
-  }
+  // Only allow relative URLs (starting with /) to prevent XSS via absolute URLs.
+  if (url.startsWith("/")) return url;
+  return "";
 }
 
 export function AdminMediaGrid() {

src/components/admin/media-picker.tsx

@@ -6,12 +6,9 @@ import { uploadMediaAndReturn } from "@/actions/admin-media";
 type MediaFile = { name: string; url: string };
 
 function validImageUrl(url: string): string {
-  try {
-    const u = new URL(url, window.location.origin);
-    return u.protocol === "http:" || u.protocol === "https:" ? u.href : "";
-  } catch {
-    return "";
-  }
+  // Only allow relative URLs (starting with /) to prevent XSS via absolute URLs.
+  if (url.startsWith("/")) return url;
+  return "";
 }
 
 export function MediaPicker({