Handle a custom path in FileSelector::convertValuesToPaths() (see #8562…

…).

system/modules/core/widgets/FileSelector.php

@@ -451,7 +451,7 @@ protected function convertValuesToPaths()
 		}
 
 		// TinyMCE will pass the path instead of the ID
-		if (strncmp($this->varValue[0], \Config::get('uploadPath') . '/', strlen(\Config::get('uploadPath')) + 1) === 0)
+		if (strpos($this->varValue[0], \Config::get('uploadPath') . '/') === 0)
 		{
 			return;
 		}
@@ -462,6 +462,12 @@ protected function convertValuesToPaths()
 			return;
 		}
 
+		// Return if the custom path is not within the upload path (see #8562)
+		if ($this->path != '' && strpos($this->path, \Config::get('uploadPath') . '/') !== 0)
+		{
+			return;
+		}
+
 		$objFiles = \FilesModel::findMultipleByIds($this->varValue);
 
 		if ($objFiles !== null)