Merge pull request #24606 from hosting-de/feature/allow-symlinks-configurable

Add 'allow Symlinks' as an option to config.php

2 files changed, 11 insertions, 3 deletions

diff --git a/config/config.sample.php b/config/config.sample.php
index 1560fe8ac39..216a32c8ebd 100644
--- a/config/config.sample.php
+++ b/config/config.sample.php
@@ -1620,6 +1620,15 @@ $CONFIG = [
 'minimum.supported.desktop.version' => '2.0.0',
 
 /**
+ * Option to allow local storage to contain symlinks.
+ * WARNING: Not recommended. This would make it possible for Nextcloud to access
+ * files outside the data directory and could be considered a security risk.
+ *
+ * Defaults to ``false``
+ */
+'localstorage.allowsymlinks' => false,
+
+/**
  * EXPERIMENTAL: option whether to include external storage in quota
  * calculation, defaults to false.
  *
diff --git a/lib/private/Files/Storage/Local.php b/lib/private/Files/Storage/Local.php
index 5d0ce596b11..81d1d083eb8 100644
--- a/lib/private/Files/Storage/Local.php
+++ b/lib/private/Files/Storage/Local.php
@@ -58,8 +58,6 @@ class Local extends \OC\Files\Storage\Common {
 
 	protected $dataDirLength;
 
-	protected $allowSymlinks = false;
-
 	protected $realDataDir;
 
 	public function __construct($arguments) {
@@ -441,7 +439,8 @@ class Local extends \OC\Files\Storage\Common {
 
 		$fullPath = $this->datadir . $path;
 		$currentPath = $path;
-		if ($this->allowSymlinks || $currentPath === '') {
+		$allowSymlinks = \OC::$server->getConfig()->getSystemValue('localstorage.allowsymlinks', false);
+		if ($allowSymlinks || $currentPath === '') {
 			return $fullPath;
 		}
 		$pathToResolve = $fullPath;