diff --git a/new.php b/new.php
index 70f82aa..a0e4dca 100644
--- a/new.php
+++ b/new.php
@@ -44,7 +44,8 @@ function write_data($dir, $post){
     }
     file_put_contents($dir . '/data.txt', implode("\n", $lines) . "\n");
 }
-function list_files($dir){ $files = array_values(array_filter(scandir($dir), fn($f)=>$f!=='.' && $f!=='..' && is_file($dir.'/'.$f) && $f !== 'data.txt')); natcasesort($files); return $files; }
+function editable_file($f){ $ext = strtolower(pathinfo((string)$f, PATHINFO_EXTENSION)); return $f !== '' && $f[0] !== '.' && $f !== 'data.txt' && in_array($ext, ['jpg','jpeg','png','webp','gif','mp4','mov','m4v','avi','mkv','webm','mp3','wav','m4a','aac','ogg','flac'], true); }
+function list_files($dir){ $files = array_values(array_filter(scandir($dir), fn($f)=>editable_file($f) && is_file($dir.'/'.$f))); natcasesort($files); return $files; }
 function orphan_videos($config){
     $referenced = [];
     foreach (input_dirs($config['uploads_dir']) as $dir) {
@@ -114,7 +115,7 @@ try {
         } elseif ($action === 'delete_file') {
             $dir = safe_input_dir($config['uploads_dir'], $_POST['dir'] ?? '');
             $file = basename((string)($_POST['file'] ?? ''));
-            if ($file === '' || $file === 'data.txt' || !is_file($dir.'/'.$file)) throw new RuntimeException('Invalid file.');
+            if (!editable_file($file) || !is_file($dir.'/'.$file)) throw new RuntimeException('Invalid file.');
             unlink($dir.'/'.$file);
             $msg = 'Removed file: ' . $file;
             $_GET['edit'] = basename($dir);