home/gitlabhq
2
0
Fork 0
mirror of https://github.com/wahyd4/gitlabhq.git synced 2026-08-11 21:56:19 +10:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'rs-help-path-traversal' into 'master'

Browse Source 
Fix path traversal in HelpController

Closes #2543

See merge request !1922
This commit is contained in:
Douwe Maan
2015-08-18 16:45:10 +00:00
parent 204914983a a42c548a8d
commit 91fa82d11f
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/help_controller.rb
+4 -2
View File
@@ -10,7 +10,8 @@ class HelpController < ApplicationController
respond_to do |format|
format.any(:markdown, :md, :html) do
path = Rails.root.join('doc', @category, "#{@file}.md")
# Note: We are purposefully NOT using `Rails.root.join`
path = File.join(Rails.root, 'doc', @category, "#{@file}.md")
if File.exist?(path)
@markdown = File.read(path)
@@ -24,7 +25,8 @@ class HelpController < ApplicationController
# Allow access to images in the doc folder
format.any(:png, :gif, :jpeg) do
path = Rails.root.join('doc', @category, "#{@file}.#{params[:format]}")
# Note: We are purposefully NOT using `Rails.root.join`
path = File.join(Rails.root, 'doc', @category, "#{@file}.#{params[:format]}")
if File.exist?(path)
send_file(path, disposition: 'inline')