Changeset 3049

Timestamp:

07/11/08 07:27:28 (7 weeks ago)

Author:

Shadowhand

Message:

Fixing #684, thanks Spoofed Existence!

Files:

• tags/2.1.3/system/libraries/Router.php (modified) (1 diff)

tags/2.1.3/system/libraries/Router.php

@@ -54 +54 @@
         }
 
-        // At this point, set the segments, rsegments, and current URI
-        // In many cases, all of these variables will match
-        self::$segments = self::$rsegments = self::$current_uri = trim(self::$current_uri, '/');
+        // At this point segments, rsegments, and current URI are all the same
+        // We trim off periods, slashes, and spaces to prevent malicious attacks
+        // using ../../ URIs.
+        self::$segments = self::$rsegments = self::$current_uri = trim(self::$current_uri, './ ');
 
         (self::$segments === 'L0LEAST3R') and include SYSPATH.'views/kohana_holiday.php';