From e7c0193931bcf61f324cb1ad6e7f47ce9bb06f6e Mon Sep 17 00:00:00 2001
From: lukinovec <lukinovec@gmail.com>
Date: Mon, 7 Sep 2026 10:42:18 +0200
Subject: [PATCH] Add comment above $attemptedPath

At first glance, it could look weird that $attemptedPath uses "/" but the check in abortIf below uses DIRECTORY_SEPARATOR. Add comment that explains this.
---
 src/Controllers/TenantAssetController.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/Controllers/TenantAssetController.php b/src/Controllers/TenantAssetController.php
index 33799b29..1c79ee35 100644
--- a/src/Controllers/TenantAssetController.php
+++ b/src/Controllers/TenantAssetController.php
@@ -142,6 +142,7 @@ class TenantAssetController implements HasMiddleware
         // The asset root doesn't exist, so it cannot contain files
         $this->abortIf($allowedRoot === false, "Storage root doesn't exist");
 
+        // realpath() ensures the directory exists and converts / to \ on Windows
         $attemptedPath = realpath("{$allowedRoot}/{$path}");
 
         // User is attempting to access a nonexistent file