owncloud/core — pull request #7287 by LukasReschke (2014-02-19 14:39:18+00:00)
Title: Hardening: Remove dangerous characters + Subdirectory Check

If an user is able to create folders in /core/l10n/ he is able to include arbitrary PHP files with today's logic.

Therefore I've added an `issubdirectory` check and removed all potential dangerous characters from `$lang`.

I think this may be useful to backport as we had recently an issue where users on IIS could create arbitrary folders.