Prevent deleting a GNS3 project outside the project directory. Ref #1669

gns3server/controller/project.py

@@ -816,9 +816,12 @@ class Project:
         await self.delete_on_computes()
         await self.close()
         try:
+            project_directory = get_default_project_directory()
+            if not os.path.commonprefix([project_directory, self.path]) == project_directory:
+                raise aiohttp.web.HTTPConflict(text="Project '{}' cannot be deleted because it is not in the default project directory: '{}'".format(self._name, project_directory))
             shutil.rmtree(self.path)
         except OSError as e:
-            raise aiohttp.web.HTTPConflict(text="Can not delete project directory {}: {}".format(self.path, str(e)))
+            raise aiohttp.web.HTTPConflict(text="Cannot delete project directory {}: {}".format(self.path, str(e)))
 
     async def delete_on_computes(self):
         """

gns3server/handlers/api/controller/project_handler.py

@@ -204,11 +204,12 @@ class ProjectHandler:
 
         controller = Controller.instance()
         config = Config.instance()
+        dot_gns3_file = request.json.get("path")
         if config.get_section_config("Server").getboolean("local", False) is False:
-            log.error("Can't load the project the server is not started with --local")
+            log.error("Cannot load '{}' because the server has not been started with the '--local' parameter".format(dot_gns3_file))
             response.set_status(403)
             return
-        project = await controller.load_project(request.json.get("path"),)
+        project = await controller.load_project(dot_gns3_file,)
         response.set_status(201)
         response.json(project)