ah, good point.  sold.


On Wed, May 21, 2014 at 2:17 PM, xithan <notifications@github.com> wrote:

> In app/controllers/card_controller.rb:
>
> > @@ -72,6 +76,14 @@ def watch
> >
> >    private
> >
> > +  def send_file_inside(allowed_path, filename, options = {})
> > +    path = File.expand_path(File.join(allowed_path, filename))
> > +    if path.match Regexp.new('^' + Regexp.escape(allowed_path))
> > +      send_file path, options
>
> I think skipping this check is not a good idea. This makes sure that we
> only hand out files in the asset folder. The filename is given by a HTTP
> parameter so you can easily try to get for example the file
> "../../../etc/passwd"
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/wagn/wagn/pull/174/files#r12919798>
> .
>



-- 
Ethan McCutchen
One of the Wagneers, Wagn.org

Wagn. How pioneers roll.

s: ethan.mccutchen
t: @intogreater