Commit 124c46d5 authored by Reed Loden's avatar Reed Loden

Bug 567981 - Restore ability for page.cgi pages to contain . characters, but…

Bug 567981 - Restore ability for page.cgi pages to contain . characters, but don't permit '..' at all. [r=mkanat a=mkanat]
parent 38337477
......@@ -66,9 +66,13 @@ my $template = Bugzilla->template;
my $id = $cgi->param('id');
if ($id) {
# Split into name and ctype, but be careful not to allow directory
# traversal.
$id =~ /^([\w\-\/]+)\.(\w+)$/;
# Be careful not to allow directory traversal.
if ($id =~ /\.\./) {
# two dots in a row is bad
ThrowCodeError("bad_page_cgi_id", { "page_id" => $id });
}
# Split into name and ctype.
$id =~ /^([\w\-\/\.]+)\.(\w+)$/;
if (!$2) {
# if this regexp fails to match completely, something bad came in
ThrowCodeError("bad_page_cgi_id", { "page_id" => $id });
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment