We should do path validation for providers that want to store files in their local filesystem, probably in the client and in the backend in the case of MSPs.
To avoid the validation being too custom one idea that came to mind was to add another configuration to the client (if local file system is used) of the root folder of the files that this provider stores. We could then make it so any read or write access to a path whose parent is not that folder is invalid
Originally posted by @TDemeco in #416 (comment)