I’ll probably limit the banners folder to be allowed only inside the wp-content/ folder (or whatever the user calls it). Taking the “easy” way out.
I just have to figure out how to do that exactly and how to move the existing folder to there, if it’s not in there. Ideas welcome. But please use email.