diff options
author | Joey Hess <joey@kitenet.net> | 2010-06-15 17:41:26 -0400 |
---|---|---|
committer | Joey Hess <joey@kitenet.net> | 2010-06-15 17:41:26 -0400 |
commit | a2989598884807ace2a9efd248b7c32824cf6c6f (patch) | |
tree | dc962057feec01a8e8745c166acbee12654551bf /IkiWiki/Render.pm | |
parent | 69383fb6b0820360ad54122d79a3c64909d01a9d (diff) | |
parent | 86a43aefb4f4c79a2044caf847622d0a00cd5356 (diff) | |
download | ikiwiki-a2989598884807ace2a9efd248b7c32824cf6c6f.tar ikiwiki-a2989598884807ace2a9efd248b7c32824cf6c6f.tar.gz |
fix other cases of unicode mixing issue
and fix underlaydir override attack guard when srcdir is non-absolute
Diffstat (limited to 'IkiWiki/Render.pm')
-rw-r--r-- | IkiWiki/Render.pm | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/IkiWiki/Render.pm b/IkiWiki/Render.pm index 0e7aa9a48..740bb52b0 100644 --- a/IkiWiki/Render.pm +++ b/IkiWiki/Render.pm @@ -292,11 +292,16 @@ sub find_src_files () { eval q{use File::Find}; error($@) if $@; + eval q{use Cwd}; + die $@ if $@; + my $origdir=getcwd(); + my $abssrcdir=Cwd::abs_path($config{srcdir}); + my ($page, $underlay); my $helper=sub { my $file=decode_utf8($_); return if -l $file || -d _; - $file=~s/^\Q.\/\E//; + $file=~s/^\.\///; return if ! length $file; $page = pagename($file); if (! exists $pagesources{$page} && @@ -313,7 +318,7 @@ sub find_src_files () { if ($underlay) { # avoid underlaydir override attacks; see security.mdwn - if (! -l "$config{srcdir}/$f" && ! -e _) { + if (! -l "$abssrcdir/$f" && ! -e _) { if (! $pages{$page}) { push @files, $f; $pages{$page}=1; @@ -329,10 +334,6 @@ sub find_src_files () { } }; - eval q{use Cwd}; - die $@ if $@; - my $origdir=getcwd(); - chdir($config{srcdir}) || die "chdir: $!"; find({ no_chdir => 1, |