From 7ae086b63f8ea76162f4c5b803eb6667ea65f23e Mon Sep 17 00:00:00 2001 From: Git'Fellow <12234510+solracsf@users.noreply.github.com> Date: Mon, 27 May 2024 19:21:03 +0200 Subject: [PATCH] Fix backport Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com> --- lib/private/Files/View.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/lib/private/Files/View.php b/lib/private/Files/View.php index f524debfb56..d047ea4e53e 100644 --- a/lib/private/Files/View.php +++ b/lib/private/Files/View.php @@ -732,6 +732,11 @@ class View { public function rename($source, $target) { $absolutePath1 = Filesystem::normalizePath($this->getAbsolutePath($source)); $absolutePath2 = Filesystem::normalizePath($this->getAbsolutePath($target)); + + if (str_starts_with($absolutePath2, $absolutePath1 . '/')) { + throw new ForbiddenException("Moving a folder into a child folder is forbidden", false); + } + $result = false; if ( Filesystem::isValidPath($target)