diff options
| -rw-r--r-- | lib/private/Files/View.php | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/lib/private/Files/View.php b/lib/private/Files/View.php index 9750186ba9b..0150a3e117a 100644 --- a/lib/private/Files/View.php +++ b/lib/private/Files/View.php @@ -20,6 +20,7 @@ use OCP\Files\Cache\ICacheEntry; use OCP\Files\ConnectionLostException; use OCP\Files\EmptyFileNameException; use OCP\Files\FileNameTooLongException; +use OCP\Files\ForbiddenException; use OCP\Files\InvalidCharacterInPathException; use OCP\Files\InvalidDirectoryException; use OCP\Files\InvalidPathException; @@ -694,6 +695,11 @@ class View { public function rename($source, $target) { $absolutePath1 = Filesystem::normalizePath($this->getAbsolutePath($source)); $absolutePath2 = Filesystem::normalizePath($this->getAbsolutePath($target)); + + if (str_starts_with($absolutePath2, $absolutePath1 . '/')) { + throw new ForbiddenException("Moving a folder into a child folder is forbidden", false); + } + $targetParts = explode('/', $absolutePath2); $targetUser = $targetParts[1] ?? null; $result = false; |