X-Git-Url: http://git.freeside.biz/gitweb/?a=blobdiff_plain;f=rt%2Fbin%2Fmason_handler.scgi.in;h=fa771b783c1dfa5744a7d389d20113f70beb7759;hb=5cdba011616de4afd742655a4a0250a26d5d049d;hp=5b6a7e2723f6d693249a8852c35949541037f09b;hpb=0fb307c305e4bc2c9c27dc25a3308beae3a4d33c;p=freeside.git

diff --git a/rt/bin/mason_handler.scgi.in b/rt/bin/mason_handler.scgi.in
index 5b6a7e272..fa771b783 100644
--- a/rt/bin/mason_handler.scgi.in
+++ b/rt/bin/mason_handler.scgi.in
@@ -57,6 +57,18 @@ require (dirname(__FILE__) . '/webmux.pl');
 require CGI;
 
 my $cgi = CGI->new;
+
+# Each environment has its own way of handling .. and so on in paths,
+# so RT consistently forbids such paths.
+if ( $cgi->path_info =~ m{/\.} ) {
+    $RT::Logger->crit("Invalid request for ".$cgi->path_info." aborting");
+    print STDOUT "HTTP/1.0 400\r\n\r\n";
+
+    RT::Interface::Web::Handler->CleanupRequest();
+
+    return 0;
+}
+
 if ( ( !$Handler->interp->comp_exists( $cgi->path_info ) )
     && ( $Handler->interp->comp_exists( $cgi->path_info . "/index.html" ) ) ) {
     $cgi->path_info( $cgi->path_info . "/index.html" );