X-Git-Url: http://git.freeside.biz/gitweb/?a=blobdiff_plain;f=rt%2Fbin%2Fmason_handler.fcgi;h=996e960764e4a8b032646a4addf1274587d264e5;hb=73a8c653d4aefdea3b5f0f99b505719f3f0d3154;hp=432296be702d6d2bbb7246b73d86cc9a603d56a7;hpb=01352af8e44b7eb70b2b587ca43ab7ca946f038d;p=freeside.git

diff --git a/rt/bin/mason_handler.fcgi b/rt/bin/mason_handler.fcgi
index 432296be7..996e96076 100755
--- a/rt/bin/mason_handler.fcgi
+++ b/rt/bin/mason_handler.fcgi
@@ -68,6 +68,17 @@ while ( my $cgi = CGI::Fast->new ) {
     Module::Refresh->refresh if RT->Config->Get('DevelMode');
     RT::ConnectToDatabase();
 
+    # Each environment has its own way of handling .. and so on in paths,
+    # so RT consistently forbids such paths.
+    if ( $cgi->path_info =~ m{/\.} ) {
+        $RT::Logger->crit("Invalid request for ".$cgi->path_info." aborting");
+        print STDOUT "HTTP/1.0 400\r\n\r\n";
+
+        RT::Interface::Web::Handler->CleanupRequest();
+
+        next;
+    }
+
     my $interp = $RT::Mason::Handler->interp;
     if (
         !$interp->comp_exists( $cgi->path_info )