From f1e717e6a10801442d1cd2926ed4a35acbb0a7d5 Mon Sep 17 00:00:00 2001
From: "Veronica K. B. Olsen" <1619840+vkbo@users.noreply.github.com>
Date: Wed, 27 May 2020 01:04:10 +0200
Subject: [PATCH 1/2] Check that the backup folder is not inside the project
 path to be backed up

---
 nw/core/project.py | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/nw/core/project.py b/nw/core/project.py
index 4516d1aa..63c79659 100644
--- a/nw/core/project.py
+++ b/nw/core/project.py
@@ -526,25 +526,25 @@ class NWProject():
             self.theParent.makeAlert((
                 "Cannot backup project because no backup path is set. "
                 "Please set a valid backup location in Tools > Preferences."
-            ), nwAlert.WARN)
+            ), nwAlert.ERROR)
             return False
 
         if self.projName is None or self.projName == "":
             self.theParent.makeAlert((
                 "Cannot backup project because no project name is set. "
                 "Please set a Working Title in Project > Project Settings."
-            ), nwAlert.WARN)
+            ), nwAlert.ERROR)
             return False
 
         if not path.isdir(self.mainConf.backupPath):
             self.theParent.makeAlert((
                 "Cannot backup project because the backup path does not exist. "
                 "Please set a valid backup location in Tools > Preferences."
-            ), nwAlert.WARN)
+            ), nwAlert.ERROR)
             return False
 
         cleanName = self.getFileSafeProjectName()
-        baseDir = path.join(self.mainConf.backupPath, cleanName)
+        baseDir = path.abspath(path.join(self.mainConf.backupPath, cleanName))
         if not path.isdir(baseDir):
             try:
                 mkdir(baseDir)
@@ -556,16 +556,25 @@ class NWProject():
                 )
                 return False
 
+        backPath = path.abspath(self.projPath)
+        if path.commonpath([backPath, baseDir]) == backPath:
+            self.theParent.makeAlert((
+                "Cannot backup project because the backup path is within the "
+                "project folder to be backed up. Please choose a different "
+                "backup path in Tools > Preferences."
+            ), nwAlert.ERROR)
+            return False
+
         archName = "Backup from %s" % formatTimeStamp(time(), fileSafe=True)
         baseName = path.join(baseDir, archName)
 
         try:
             self._clearLockFile()
-            make_archive(baseName, "zip", self.projPath, ".")
+            make_archive(baseName, "zip", backPath, ".")
             self._writeLockFile()
             if doNotify:
                 self.theParent.makeAlert(
-                    "Backup archive file written to: '%s.zip'" % path.join(cleanName, archName),
+                    "Backup archive file written to: %s.zip" % path.join(cleanName, archName),
                     nwAlert.INFO
                 )
             else:

From 7c78eff5eac817be95352fbbfbf36e0df4d57735 Mon Sep 17 00:00:00 2001
From: "Veronica K. B. Olsen" <1619840+vkbo@users.noreply.github.com>
Date: Wed, 27 May 2020 16:35:09 +0200
Subject: [PATCH 2/2] Some more path checks. Should be fine now.

---
 nw/config.py       | 6 +++---
 nw/core/project.py | 7 +++----
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/nw/config.py b/nw/config.py
index fbb384ab..bc40259b 100644
--- a/nw/config.py
+++ b/nw/config.py
@@ -424,7 +424,7 @@ class Config:
         ## Backup
         cnfSec = "Backup"
         self.backupPath = self._parseLine(
-            cnfParse, cnfSec, "backuppath", self.CNF_STR,  self.backupPath
+            cnfParse, cnfSec, "backuppath", self.CNF_STR, self.backupPath
         )
         self.backupOnClose = self._parseLine(
             cnfParse, cnfSec, "backuponclose", self.CNF_BOOL, self.backupOnClose
@@ -639,7 +639,7 @@ class Config:
         if newPath is None:
             return True
         if not path.isfile(newPath):
-            logger.error("Config: File not found. Using default config path instead.")
+            logger.error("File not found, using default config path instead")
             return False
         self.confPath = path.dirname(newPath)
         self.confFile = path.basename(newPath)
@@ -649,7 +649,7 @@ class Config:
         if newPath is None:
             return True
         if not path.isdir(newPath):
-            logger.error("Config: Path not found. Using default data path instead.")
+            logger.error("Path not found, using default data path instead")
             return False
         self.dataPath = path.abspath(newPath)
         return True
diff --git a/nw/core/project.py b/nw/core/project.py
index 63c79659..1b63cc0f 100644
--- a/nw/core/project.py
+++ b/nw/core/project.py
@@ -556,8 +556,7 @@ class NWProject():
                 )
                 return False
 
-        backPath = path.abspath(self.projPath)
-        if path.commonpath([backPath, baseDir]) == backPath:
+        if path.commonpath([self.projPath, baseDir]) == self.projPath:
             self.theParent.makeAlert((
                 "Cannot backup project because the backup path is within the "
                 "project folder to be backed up. Please choose a different "
@@ -570,7 +569,7 @@ class NWProject():
 
         try:
             self._clearLockFile()
-            make_archive(baseName, "zip", backPath, ".")
+            make_archive(baseName, "zip", self.projPath, ".")
             self._writeLockFile()
             if doNotify:
                 self.theParent.makeAlert(
@@ -603,7 +602,7 @@ class NWProject():
         else:
             if projPath.startswith("~"):
                 projPath = path.expanduser(projPath)
-            self.projPath = projPath
+            self.projPath = path.abspath(projPath)
         self.setProjectChanged(True)
         return True