#
# COPYRIGHT:
#
-# This software is Copyright (c) 1996-2011 Best Practical Solutions, LLC
+# This software is Copyright (c) 1996-2013 Best Practical Solutions, LLC
# <sales@bestpractical.com>
#
# (Except where explicitly superseded by other copyright notices)
while( my $cgi = CGI::Fast->new ) {
my $comp = $ENV{'PATH_INFO'};
+ # Each environment has its own way of handling .. and so on in paths,
+ # so RT consistently forbids such paths.
+ if ( $cgi->path_info =~ m{/\.} ) {
+ $RT::Logger->crit("Invalid request for ".$cgi->path_info." aborting");
+ print STDOUT "HTTP/1.0 400\r\n\r\n";
+
+ RT::Interface::Web::Handler->CleanupRequest();
+
+ next;
+ }
+
$comp = $1 if ($comp =~ /^(.*)$/);
my $web_path = RT->Config->Get('WebPath');
$comp =~ s|^\Q$web_path\E\b||i;