archive: prevent crossing user boundary

2023-03-03 12:29:17 -08:00 · 2023-03-03 12:29:17 -08:00 · 2bfb04702e
parent 1cad7828e6
commit 2bfb04702e
1 changed files with 5 additions and 0 deletions
--- a/lib/Controller/ArchiveController.php
+++ b/lib/Controller/ArchiveController.php
@ -89,6 +89,11 @@ class ArchiveController extends ApiBase
                break;
            }

+            // Hit the user's root folder
+            if ($parent->getPath() === $userFolder->getPath()) {
+                break;
+            }
+
            // Hit a storage root
            try {
                if ($parent->getParent()->getStorage()->getId() !== $fileStorageId) {