Add 'allow Symlinks' as an option to config.php

Signed-off-by: Johannes Leuker <j.leuker@hosting.de>

Author: Johannes Leuker

config/config.sample.php

@@ -1603,6 +1603,15 @@
  */
 'minimum.supported.desktop.version' => '2.0.0',
 
+/**
+ * Option to allow local storage to contain symlinks.
+ * WARNING: Not recommended. This would make it possible for Nextcloud to access
+ * files outside the data directory and could be considered a security risk.
+ *
+ * Defaults to ``false``
+ */
+'localstorage.allowsymlinks' => false,
+
 /**
  * EXPERIMENTAL: option whether to include external storage in quota
  * calculation, defaults to false.

lib/private/Files/Storage/Local.php

@@ -57,8 +57,6 @@ class Local extends \OC\Files\Storage\Common {
 
 	protected $dataDirLength;
 
-	protected $allowSymlinks = false;
-
 	protected $realDataDir;
 
 	public function __construct($arguments) {
@@ -441,7 +439,8 @@ public function getSourcePath($path) {
 
 		$fullPath = $this->datadir . $path;
 		$currentPath = $path;
-		if ($this->allowSymlinks || $currentPath === '') {
+		$allowSymlinks = \OC::$server->getConfig()->getSystemValue('localstorage.allowsymlinks', false);
+		if ($allowSymlinks || $currentPath === '') {
 			return $fullPath;
 		}
 		$pathToResolve = $fullPath;