From 66d36bffa61f6c173e48680e6e000bbd16ff1614 Mon Sep 17 00:00:00 2001
From: Robin Appelman <robin@icewind.nl>
Date: Wed, 24 Apr 2024 14:50:13 +0200
Subject: [PATCH] fix: forbid moving a folder into a subfolder of itself

Signed-off-by: Robin Appelman <robin@icewind.nl>
---
 lib/private/Files/View.php | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/private/Files/View.php b/lib/private/Files/View.php
index a6e57d775ed5a..b8a08052cc993 100644
--- a/lib/private/Files/View.php
+++ b/lib/private/Files/View.php
@@ -59,6 +59,7 @@
 use OCP\Files\ConnectionLostException;
 use OCP\Files\EmptyFileNameException;
 use OCP\Files\FileNameTooLongException;
+use OCP\Files\ForbiddenException;
 use OCP\Files\InvalidCharacterInPathException;
 use OCP\Files\InvalidDirectoryException;
 use OCP\Files\InvalidPathException;
@@ -733,6 +734,11 @@ public function deleteAll($directory) {
 	public function rename($source, $target) {
 		$absolutePath1 = Filesystem::normalizePath($this->getAbsolutePath($source));
 		$absolutePath2 = Filesystem::normalizePath($this->getAbsolutePath($target));
+
+		if (str_starts_with($absolutePath2, $absolutePath1 . '/')) {
+			throw new ForbiddenException("Moving a folder into a child folder is forbidden", false);
+		}
+
 		$targetParts = explode('/', $absolutePath2);
 		$targetUser = $targetParts[1] ?? null;
 		$result = false;