diff options
author | ivan <ivan> | 2011-04-18 23:15:19 +0000 |
---|---|---|
committer | ivan <ivan> | 2011-04-18 23:15:19 +0000 |
commit | 75162bb14b3e38d66617077843f4dfdcaf09d5c4 (patch) | |
tree | d89dd49a476cf2f0859ed6a0adc2992ea6d69d04 /rt/bin/mason_handler.fcgi.in | |
parent | fc6209f398899f0211cfcedeb81a3cd65e04a941 (diff) |
import rt 3.8.10
Diffstat (limited to 'rt/bin/mason_handler.fcgi.in')
-rw-r--r-- | rt/bin/mason_handler.fcgi.in | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/rt/bin/mason_handler.fcgi.in b/rt/bin/mason_handler.fcgi.in index b980bc188..4682abf16 100644 --- a/rt/bin/mason_handler.fcgi.in +++ b/rt/bin/mason_handler.fcgi.in @@ -68,6 +68,17 @@ while ( my $cgi = CGI::Fast->new ) { Module::Refresh->refresh if RT->Config->Get('DevelMode'); RT::ConnectToDatabase(); + # Each environment has its own way of handling .. and so on in paths, + # so RT consistently forbids such paths. + if ( $cgi->path_info =~ m{/\.} ) { + $RT::Logger->crit("Invalid request for ".$cgi->path_info." aborting"); + print STDOUT "HTTP/1.0 400\r\n\r\n"; + + RT::Interface::Web::Handler->CleanupRequest(); + + next; + } + my $interp = $RT::Mason::Handler->interp; if ( !$interp->comp_exists( $cgi->path_info ) |