* remove buildWhere with the SQL injection

* remove buildWhere with the SQL injection

to escape the configured path.

Also wrap error message in htmlspecialchars.

Co-authored-by: Dave MacFarlane <dave.macfarlane@mcin.ca>

The webpack config is incorrectly only copying one (production or dev)
version of react to htdocs. This causes the login page to stop loading
based on the sandbox flag, which may be trying to load one or the other.

The decision to copy or not in webpack is based on a NODE_ENV
environment variable which is not used or documented anywhere in LORIS,
and LORIS may dynamically choose one or the other based on the
configuration variable which can be changed without recompiling.

Go back to copying both so that LORIS will load regardless of the
sandbox flag.

Fixes #10425
Fixes #10400

* [security- document_repository] Adds BackEnd per site validation to match FrontEnd.

* Keeps 27 and 28 release compatibility.

---------

Co-authored-by: lorisadmin <rolando.acosta@mcin.ca>

* Fix help content output

* Set content-type: json to ajax help response

* Remove extra line

* Add file_exists check

* [security - publication] Takes loris URL from server side, not from the form POST.

* Takes out the reference to the direct link from templates.

---------

Co-authored-by: lorisadmin <rolando.acosta@mcin.ca>

* [media] Permissions fix

* Revert "Delete modules/media directory"

This reverts commit c009e9f8275db6f2777a8d3937d58e2d65e8b6f6.

Co-authored-by: Dave MacFarlane <dave.macfarlane@mcin.ca>

* login redirect fix

* url redirect - string and trim