All pastes #425392 Raw Edit

Unnamed

public text v1 · immutable
·published 2007-04-05 13:42 UTC
rendered paste body
  def sanitize_directory
    if params[:CurrentFolder]
      clean = File.expand_path(File.join(RAILS_ROOT, 'public', Fckeditor.config[:upload_dir]))
      dirty = File.expand_path(@options[:dir])
      dirty = File.expand_path('../' + @options[:dir]) if Dir.pwd.ends_with?('/public')

      unless dirty.starts_with?(clean)
        render :nothing => true, :status => 403
        false
      end
    end
  end