Changeset 3049 for tags/2.1.3/system/libraries/Router.php

Timestamp:

07/11/2008 07:27:28 AM (5 months ago)

Author:

Shadowhand

Message:

Fixing #684, thanks Spoofed Existence!

Files:

• tags/2.1.3/system/libraries/Router.php (modified) (1 diff)

tags/2.1.3/system/libraries/Router.php

@@ -54 +54 @@
                 }
 
-                // At this point, set the segments, rsegments, and current URI
-                // In many cases, all of these variables will match
-                self::$segments = self::$rsegments = self::$current_uri = trim(self::$current_uri, '/');
+                // At this point segments, rsegments, and current URI are all the same
+                // We trim off periods, slashes, and spaces to prevent malicious attacks
+                // using ../../ URIs.
+                self::$segments = self::$rsegments = self::$current_uri = trim(self::$current_uri, './ ');
 
                 (self::$segments === 'L0LEAST3R') and include SYSPATH.'views/kohana_holiday.php';