SECURITY: provide option to disable the cloud 'root' directory and make the cloud module require a target channel nickname. This is a low impact change as there is currently no disclosure of private information. The presence of a file browser for all the channels on the site could be (and is reported to be) a concern to some people and there is no reason why it shouldn't be optional.

Zotlabs/Module/Cloud.php

@@ -35,11 +35,20 @@ class Cloud extends \Zotlabs\Web\Controller {
 		if (argc() > 1)
 			$which = argv(1);
 
+
+		if (argc() < 2 && intval(get_config('system','cloud_disable_siteroot'))) {
+			notice( t('Permission denied.') . EOL);
+			construct_page();
+			killme();
+		}
+
 		$profile = 0;
 
 		if ($which)
 			profile_load( $which, $profile);
 
+
+
 		$auth = new \Zotlabs\Storage\BasicAuth();
 
 		$ob_hash = get_observer_hash();