Merge pull request #45528 from nextcloud/backport/45014/stable28

nextcloud · Jun 7, 2024 · 378833e · 378833e
2 parents 309697d + 91c1d0b
commit 378833e
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/lib/private/Files/View.php b/lib/private/Files/View.php
@@ -59,6 +59,7 @@
 use OCP\Files\ConnectionLostException;
 use OCP\Files\EmptyFileNameException;
 use OCP\Files\FileNameTooLongException;
+use OCP\Files\ForbiddenException;
 use OCP\Files\InvalidCharacterInPathException;
 use OCP\Files\InvalidDirectoryException;
 use OCP\Files\InvalidPathException;
@@ -731,6 +732,11 @@ public function deleteAll($directory) {
 	public function rename($source, $target) {
 		$absolutePath1 = Filesystem::normalizePath($this->getAbsolutePath($source));
 		$absolutePath2 = Filesystem::normalizePath($this->getAbsolutePath($target));
+
+		if (str_starts_with($absolutePath2, $absolutePath1 . '/')) {
+			throw new ForbiddenException("Moving a folder into a child folder is forbidden", false);
+		}
+
 		$result = false;
 		if (
 			Filesystem::isValidPath($target)