X-Git-Url: http://git.freeside.biz/gitweb/?p=freeside.git;a=blobdiff_plain;f=rt%2Fbin%2Fmason_handler.svc;h=6275a9e591097def14c28b2ae3033bf999ab2eee;hp=c87c275f8e17c20601e33e147a7ea1b03b1903d6;hb=75162bb14b3e38d66617077843f4dfdcaf09d5c4;hpb=fc6209f398899f0211cfcedeb81a3cd65e04a941

diff --git a/rt/bin/mason_handler.svc b/rt/bin/mason_handler.svc
index c87c275f8..6275a9e59 100644
--- a/rt/bin/mason_handler.svc
+++ b/rt/bin/mason_handler.svc
@@ -1,4 +1,4 @@
-#!/Users/falcone/perl5/perlbrew/bin/perl
+#!/usr/bin/perl
 # BEGIN BPS TAGGED BLOCK {{{
 #
 # COPYRIGHT:
@@ -234,6 +234,17 @@ $Handler ||= RT::Interface::Web::Handler->new(
 while( my $cgi = CGI::Fast->new ) {
     my $comp = $ENV{'PATH_INFO'};
 
+    # Each environment has its own way of handling .. and so on in paths,
+    # so RT consistently forbids such paths.
+    if ( $cgi->path_info =~ m{/\.} ) {
+        $RT::Logger->crit("Invalid request for ".$cgi->path_info." aborting");
+        print STDOUT "HTTP/1.0 400\r\n\r\n";
+
+        RT::Interface::Web::Handler->CleanupRequest();
+
+        next;
+    }
+
     $comp = $1 if ($comp =~ /^(.*)$/);
     my $web_path = RT->Config->Get('WebPath');
     $comp =~ s|^\Q$web_path\E\b||i;