#210 security hole in storage

[Bela Hullar]

the getFile method of storage should only accept a path which points to a file in the storage folder and/or it should use some kind of authentication.
The following call works with guse version 3.5.7 and also with 3.6.2 and returns a file from the user directory. In the same way arbitrary file can be accessed by anyone.
:8080/storage/getFile?path=../users/.quota

[Karóczkai Krisztián]

Fixed