Config setting to safely allow Members-visible folders

[jefft]

Fixes #1224.

This PR introduces a 'Member Visible Folders' system configuration setting:

This makes visible an otherwise-hidden feature (#1224).

As the help text says, these folders are relative to DOCUMENTS_ROOT_PATH, even if filled in as an absolute path (/Members/Meetings/).

Implementation

Jethro has a MEMBER_FILES_DIRS constant, but this is not exposed in the System Configuration, so is not discoverable. I don't think we can safely expose MEMBER_FILES_DIRS, because, for reasons I don't understand, it accepts arbitrary absolute paths.

So I've introduced a new constant, MEMBER_VISIBLE_FOLDERS, which is a relative-only replacement for MEMBER_FILES_DIRS intended to be set in system configuration, not conf.php.

The code is backwards-compatible, so MEMBER_FILES_DIRS is still supported if set. The code does the right thing if MEMBER_FILES_DIRS and MEMBER_VISIBLE_FOLDERS are both set, although that would be unusual. There is a note in conf.php.sample suggesting people use 'Member Visible Folders' config setting.

[tbar0970]

Note to self:
Test case I'd like to run:
If a member_visible_folder includes "../" what happens?

[jefft]

If a member_visible_folder includes "../" what happens?

I checked, and everything broke. My code was over-general and a bit rubbish.

I've rewritten the patch to use a new, simpler, safe_subdirectory($base, $path) function in general.php, that ensures $path is within $base and explicitly checks for ...

[jefft]

Bug #1334 affects MEMBERS_FILES_DIRS, which per this PR I'd like to deprecate in favour of MEMBER_VISIBLE_FOLDERS. But is there an equivalent bug affecting MEMBER_VISIBLE_FOLDERS?

Answer: no. A blank (or whitespace) MEMBER_VISIBLE_FOLDERS results in no folders being shown to members.

Currently this also means that it isn't possible to show all Documents to members. The members-shared directory has to be a subdirectory of DOCUMENTS_ROOT_PATH. I think that's good default behaviour, e.g. so staff can't accidentally overshare stuff with members.

[jefft]

Replaced by #1347