Changeset 3058

Timestamp:

07/11/2008 09:04:05 AM (3 months ago)

Author:

Shadowhand

Message:

Follow up to r3049, fixing #684.

Files:

• trunk/system/libraries/Router.php (modified) (2 diffs)

trunk/system/libraries/Router.php

@@ -67 +67 @@
                 self::$current_uri = html::specialchars(self::$current_uri, FALSE);
 
+                // Remove all dot-paths from the URI, they are not valid
+                self::$current_uri = str_replace(array('../', './'), '', self::$current_uri);
+
                 // At this point segments, rsegments, and current URI are all the same
-                // We trim off periods, slashes, and spaces to prevent malicious attacks
-                // using ../../ URIs.
-                self::$segments = self::$rsegments = self::$current_uri = trim(self::$current_uri, './ ');
+                self::$segments = self::$rsegments = self::$current_uri = trim(self::$current_uri, '/');
 
                 // Set the complete URI
@@ -112 +113 @@
                                         if (is_file($dir.$controller_path.EXT))
                                         {
-                                                // Set controller subdirectory if any
-                                                self::$controller_dir = substr($controller_path, 0, strrpos($controller_path, '/'));
-
                                                 // Set controller name
                                                 self::$controller = $segment;