zip

Hello,

When backups are run with --disable-notifications options, the resulting zip file is never encrypted.

It looks like this is coming from the fact encryption occurs as an event wrapped in the send notification method in BackupJob.php:

    protected function sendNotification($notification): void
    {
        if ($this->sendNotifications) {
            rescue(
         

I was able to confirm that os.Create() will happily follow symlinks.

Although standard tools like tar will not likely allow you to add two files with the same name to an archive file, it's certainly easy enough to do in code. This means that we need to add an additional check before writing to a destination to make sure that it's not a symlink outside of the destination.

The vulnerab