prevent creating folders in the files parent directory

eNMS/controller.py

@@ -1494,7 +1494,7 @@ def update_device_rbac(self):
 
     def upload_files(self, **kwargs):
         path = f"{vs.file_path}/{kwargs['folder']}/{kwargs['file'].filename}"
-        if not str(Path(path).resolve()).startswith(str(vs.file_path)):
+        if not str(Path(path).resolve()).startswith(f"{vs.file_path}/"):
             return {"error": "The path resolves outside of the files folder."}
         kwargs["file"].save(path)
 

eNMS/models/administration.py

@@ -251,7 +251,7 @@ class File(AbstractBase):
     def update(self, move_file=True, **kwargs):
         old_path = self.full_path
         self.full_path = f"{vs.file_path}{kwargs['path']}"
-        if not str(Path(self.full_path).resolve()).startswith(str(vs.file_path)):
+        if not str(Path(self.full_path).resolve()).startswith(f"{vs.file_path}/"):
             raise Exception("The path resolves outside of the files folder.")
         super().update(**kwargs)
         if exists(str(old_path)) and not exists(self.full_path) and move_file: