Changeset 3059 for tags/2.1.3

Timestamp:

07/11/2008 09:04:42 AM (5 months ago)

Author:

Shadowhand

Message:

Copied some things from Router from trunk to tags/2.1.3, follow up to r3058.

Files:

• tags/2.1.3/system/libraries/Router.php (modified) (1 diff)

tags/2.1.3/system/libraries/Router.php

@@ -54 +54 @@
                 }
 
+                // Make sure the URL is not tainted with HTML characters
+                self::$current_uri = html::specialchars(self::$current_uri, FALSE);
+
+                // Remove all dot-paths from the URI, they are not valid
+                self::$current_uri = str_replace(array('../', './'), '', self::$current_uri);
+
                 // At this point segments, rsegments, and current URI are all the same
-                // We trim off periods, slashes, and spaces to prevent malicious attacks
-                // using ../../ URIs.
-                self::$segments = self::$rsegments = self::$current_uri = trim(self::$current_uri, './ ');
+                self::$segments = self::$rsegments = self::$current_uri = trim(self::$current_uri, '/');
 
                 (self::$segments === 'L0LEAST3R') and include SYSPATH.'views/kohana_holiday.php';