diff options
Diffstat (limited to 'rt/bin/mason_handler.fcgi.in')
| -rw-r--r-- | rt/bin/mason_handler.fcgi.in | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/rt/bin/mason_handler.fcgi.in b/rt/bin/mason_handler.fcgi.in index b980bc188..4682abf16 100644 --- a/rt/bin/mason_handler.fcgi.in +++ b/rt/bin/mason_handler.fcgi.in @@ -68,6 +68,17 @@ while ( my $cgi = CGI::Fast->new ) { Module::Refresh->refresh if RT->Config->Get('DevelMode'); RT::ConnectToDatabase(); + # Each environment has its own way of handling .. and so on in paths, + # so RT consistently forbids such paths. + if ( $cgi->path_info =~ m{/\.} ) { + $RT::Logger->crit("Invalid request for ".$cgi->path_info." aborting"); + print STDOUT "HTTP/1.0 400\r\n\r\n"; + + RT::Interface::Web::Handler->CleanupRequest(); + + next; + } + my $interp = $RT::Mason::Handler->interp; if ( !$interp->comp_exists( $cgi->path_info ) |