Arbitrary file read via path prefix confusion

Authorization bypass in OpenList before 4.2.4 allows remote authenticated users to read files outside BasePath via crafted share paths. In server/handles/sharing.go, the CreateSharing and UpdateSharing handlers authorize requested files with strings.HasPrefix against user.BasePath, so sibling paths such as /base2/secret.txt pass because no directory-boundary check is applied. Exploitation requires an authenticated account with CanShare permission, after which public share download or list handlers serve the stored out-of-scope file path and disclose unauthorized data without a write impact.