prevent access of wiki files

This prevents the crawler to descent into the wiki directory or data
directory, even when for some reason a higher up directory was made
accessible. This should prevent the circumvention of ACLs and prevent
access to sensitive data like user password hashes etc.

Crawler.php

@@ -57,6 +57,9 @@ class Crawler
     {
         $path = $root . $local;
 
+        // do not descent into wiki or data directories
+        if(Path::isWikiControlled($path)) return [];
+
         if (($dir = opendir($path)) === false) return [];
         $result = [];
         while (($file = readdir($dir)) !== false) {