Changeset 3048

Timestamp:

07/11/2008 07:26:30 AM (5 months ago)

Author:

Shadowhand

Message:

Fixing #684, thanks Spoofed Existence!

Files:

• trunk/system/libraries/Router.php (modified) (4 diffs)

trunk/system/libraries/Router.php

@@ -68 +68 @@
 
                 // At this point segments, rsegments, and current URI are all the same
-                self::$segments = self::$rsegments = self::$current_uri = trim(self::$current_uri, '/');
+                // We trim off periods, slashes, and spaces to prevent malicious attacks
+                // using ../../ URIs.
+                self::$segments = self::$rsegments = self::$current_uri = trim(self::$current_uri, './ ');
+
+                echo Kohana::debug(self::$segments);exit;
 
                 // Set the complete URI
@@ -89 +93 @@
                 $method_segment  = NULL;
 
+                // Paths to search
+                $paths = Config::include_paths();
+
                 foreach (self::$rsegments as $key => $segment)
                 {
@@ -94 +101 @@
                         $controller_path .= $segment;
 
+                        echo Kohana::debug($segment);
+
                         $found = FALSE;
-                        $paths = Config::include_paths();
-
                         foreach ($paths as $dir)
                         {
@@ -149 +156 @@
                 }
 
+                exit;
                 // Last chance to set routing before a 404 is triggered
                 Event::run('system.post_routing');