Fix: Apply security hardening to WebUI and WebServer backend - #91

Thanks for the contribution — the C++ fixes in particular are tight and address real issues. A few things from a deeper review:

Whitelists vs my_cmp() switches

• amuleweb-main-servers.php — 4 keys (name, desc, users, files), match switch + header links exactly.
• amuleweb-main-shared.php — 9 keys (size, name, xfer, xfer_all, acc, acc_all, req, req_all, prio), match switch + header links exactly.
• amuleweb-main-dload.php — whitelist correctly mirrors the switch (size, size_done, progress, name, speed, scrcount, status, prio). But there's a pre-existing typo between the switch and the column header at amuleweb-main-dload.php line 277: the "Sources" header link emits ?sort=srccount, while my_cmp's case label is "scrcount" (transposed cr). So clicking the Sources column falls through every case and produces no sort change. Not introduced by this PR, but since you're already touching this file, would you mind folding the fix in here? Easiest is to rename the case label from "scrcount" to "srccount" in both my_cmp and your whitelist — that way the column starts working AND stays correct under the whitelist.

Other items

1. The ## Test plan section in the PR body is still a template placeholder. For a security-grade change, particularly the EC null-deref / OOB-read fixes in WebServer.cpp, a brief description of how each fix was verified (manual amuleweb hit while killing the EC connection? synthetic truncated STATSGRAPH_DATA tag?) would help reviewers and future bisects.

2. How were these issues found — static analyzer, fuzzer, manual review? Knowing the source would help judge whether nearby code likely has similar issues. The SendRecvMsg_v2 return value is dereferenced unchecked in several other WebServer.cpp paths (e.g. the connection/disconnection helpers), so if this came from a tool, it might surface more.

3. The #869 references in the PHP comments — that's the legacy amule-project/amule tracker, not amule-org/amule. Either qualify it (amule-project/amule#869) or drop the reference, since the current convention is to track issues on amule-org.

C++ fixes all look correct:

• Send_DownloadEd2k_Cmd: returning true on null response matches the function's failure semantics.
• ReQuery: null-response + null-dataTag + count -= count % 4 clamp + the previously-missing delete response — four real issues fixed in one hunk.
• Gzip buffer formula matches the zlib deflate() worst-case (sourceLen + sourceLen/1000 + 12) plus the 18-byte gzip wrapper. Low practical severity (only triggers above ~994 KB payloads, which amuleweb pages don't reach today) but the right contract to honor.

Approving once the test plan is filled in.

@peyoker thank you. I tested it and it's good. I made a small fix before merging.