<ul><li>CRITICAL: Fixed branding_js.php getSiteId/curSiteId using wrong session key $_SESSION[SiteLinkId] (undefined) instead of $_SESSION[YPSiteLinkID] — all image uploads were posting empty sitelinkid, causing failures or saves to wrong site. Also added intval() sanitization on $_GET[siteid].</li><li>HIGH: Fixed branding_js.php delete_image success handler referencing undefined variable $data instead of $result — notification always showed warning even on successful delete.</li><li>HIGH: Fixed websites.controller.php manifestContent() N+1 query — replaced 10+ individual $this->gc->domain_names_sites($sitelinkid, field) calls (one DB query each) with a single Sdba::table fetch before the manifest string build.</li><li>MEDIUM: Fixed websites.controller.php topbarcss() — missing return statements in multiple code paths (empty child sites array, initial update failure) caused null JSON response → data.code undefined → notification always showed warning. Refactored to early-return on failure with all paths covered.</li><li>MEDIUM: Fixed websites.controller.php updateWebsiteSettings() — $r[saveType] undefined index PHP notice when action is a toggle (multisite_type, name/value updates) rather than full form save. Changed to ($r[saveType] ?? "") == "settings".</li><li>LOW: Fixed js_functions.php iteratedata() XSS — val.subdomainname injected raw into HTML string. Replaced with jQuery .text() HTML-escape. Also parseInt() on DomainSiteLinkId in onclick attributes.</li><li>SECURITY: Fixed websites.controller.php deleteappbrand() — $r[img] from user input prepended to BASEPATH then passed to unlink() without path validation. Added realpath() check to confirm resolved path stays within /website/assets/.</li><li>Backed up all three modified files before changes.</li></ul>