X-Git-Url: http://git.freeside.biz/gitweb/?a=blobdiff_plain;f=rt%2Fbin%2Ffastcgi_server.in;h=945e7d699454cfd68d71c7ec64a0502b9b7f92fb;hb=d32f4c43b0fde5c18b8c2ee8f3d4cb9c6861a403;hp=2aa953168df501aad9e662e5db3faefae0f8e101;hpb=fc6209f398899f0211cfcedeb81a3cd65e04a941;p=freeside.git

diff --git a/rt/bin/fastcgi_server.in b/rt/bin/fastcgi_server.in
index 2aa953168..945e7d699 100644
--- a/rt/bin/fastcgi_server.in
+++ b/rt/bin/fastcgi_server.in
@@ -3,7 +3,7 @@
 #
 # COPYRIGHT:
 #
-# This software is Copyright (c) 1996-2011 Best Practical Solutions, LLC
+# This software is Copyright (c) 1996-2013 Best Practical Solutions, LLC
 #                                          <sales@bestpractical.com>
 #
 # (Except where explicitly superseded by other copyright notices)
@@ -230,6 +230,18 @@ while ( my $cgi = CGI::Fast->new ) {
     Module::Refresh->refresh if RT->Config->Get('DevelMode');
     RT::ConnectToDatabase();
 
+    # Each environment has its own way of handling .. and so on in paths,
+    # so RT consistently forbids such paths.
+    if ( $cgi->path_info =~ m{/\.} ) {
+        $RT::Logger->crit("Invalid request for ".$cgi->path_info." aborting");
+        print STDOUT "HTTP/1.0 400\r\n\r\n";
+
+        RT::Interface::Web::Handler->CleanupRequest();
+        $proc_manager->pm_post_dispatch;
+
+        next;
+    }
+
     my $interp = $RT::Mason::Handler->interp;
     if (
         !$interp->comp_exists( $cgi->path_info )