Only follow symlinks within configured static file handler directory

[spinscale]

This adds an additional check to only follow symlinks that are within the configured public directory of a static file handler.

This ensures a malicious user cannot link to any files outside of the public directory to prevent reading arbitrary files.

[straight-shoota]

I'm not sure if this is a great enhancement. It's too restrictive. A harmless user might link a file outside the public directory with honest intentions. This is a quite common practice, actually. I wouldn't want to disable that.

And a malicious user would need write access to the public directory in the first place, in order to link to something outside of it.

Maybe this could be an optional feature?

[spinscale]

interesting. I did consider this more of a security issue, as the person running an app is not necessarily the same administering the system. Would you accept this, when this is made configurable? Then I'm happy to change.

[straight-shoota]

Having this as an option should be fine.