given openproject runs in a subdirectory we cannot allow redirecting to ...

...a different subdirectory. also tries to catch shenanigans to circumvent the check like ".." in the path.

see: https://www.openproject.org/work_packages/14467