X-Git-Url: http://git.freeside.biz/gitweb/?a=blobdiff_plain;f=rt%2Fbin%2Fmason_handler.svc.in;h=09d5ef2661667737651b668cd97a2a4627a5d48c;hb=311711639b41a5b307243d99c1aefceadcc97548;hp=2cbf4357aa9f4eb8ec5d128863bcaeea85fcc7ea;hpb=0fb307c305e4bc2c9c27dc25a3308beae3a4d33c;p=freeside.git

diff --git a/rt/bin/mason_handler.svc.in b/rt/bin/mason_handler.svc.in
index 2cbf4357a..09d5ef266 100644
--- a/rt/bin/mason_handler.svc.in
+++ b/rt/bin/mason_handler.svc.in
@@ -3,7 +3,7 @@
 #
 # COPYRIGHT:
 #
-# This software is Copyright (c) 1996-2011 Best Practical Solutions, LLC
+# This software is Copyright (c) 1996-2013 Best Practical Solutions, LLC
 #                                          <sales@bestpractical.com>
 #
 # (Except where explicitly superseded by other copyright notices)
@@ -234,6 +234,17 @@ $Handler ||= RT::Interface::Web::Handler->new(
 while( my $cgi = CGI::Fast->new ) {
     my $comp = $ENV{'PATH_INFO'};
 
+    # Each environment has its own way of handling .. and so on in paths,
+    # so RT consistently forbids such paths.
+    if ( $cgi->path_info =~ m{/\.} ) {
+        $RT::Logger->crit("Invalid request for ".$cgi->path_info." aborting");
+        print STDOUT "HTTP/1.0 400\r\n\r\n";
+
+        RT::Interface::Web::Handler->CleanupRequest();
+
+        next;
+    }
+
     $comp = $1 if ($comp =~ /^(.*)$/);
     my $web_path = RT->Config->Get('WebPath');
     $comp =~ s|^\Q$web_path\E\b||i;