[security:CVE-2022-26960] fix a path traversal issue

Fixed a paste traversal vulnerability. The problem was getting out of
the configured directory and allowing the hosting server's file system
to read and write "arbitrary" files.

Special thanks to Gaetan Ferry (Synacktiv) for reporting this issue.

php/elFinderVolumeLocalFileSystem.class.php

@@ -485,6 +485,7 @@ class elFinderVolumeLocalFileSystem extends elFinderVolumeDriver
         if ($path === DIRECTORY_SEPARATOR) {
             return $this->root;
         } else {
+            $path = $this->_normpath($path);
             if (strpos($path, $this->systemRoot) === 0) {
                 return $path;
             } else if (DIRECTORY_SEPARATOR !== '/' && preg_match('/^[a-zA-Z]:' . preg_quote(DIRECTORY_SEPARATOR, '/') . '/', $path)) {