pub fn write_requested_below(
root: &Path,
requested: &Path,
jailed: &Path,
content: &[u8],
) -> Result<PathBuf, String>Expand description
Write a caller-chosen destination below root: the lexical requested
path when it names plain components below root (a symlinked component
then stays visible and is refused), else the jail-resolved jailed path.
A jailed path outside root (an extra jail root the user allowed, or a
disabled jail) keeps working: its parent directory, which the jail already
resolved, is the trusted root and only the file itself must not be a link.