Pita/etherpad-lite — Issue #317: app.get(/static): set option redirect:false
Author: yvesf
Created: 2012-01-07 23:40:54+00:00
State: open

In the function:

```javascript
app.get('/static/*', function(req, res)
{
res.header("Server", serverName);
var filePath = path.normalize(__dirname + "/.." +
req.url.replace(/\.\./g, '').split("?")[0]);
res.sendfile(filePath, { maxAge: exports.maxAge, redirect: false});
});
```

The option "redirect" given to [express response.js `sendfile()`](https://github.com/visionmedia/express/blob/master/lib/response.js#L234) is used in [connect static.js `send()`](https://github.com/senchalabs/connect/blob/master/lib/middleware/static.js#L134) to determine if "/foo/directory" should be redirected to "/foo/directory/" to trigger eventual "index.html".

Because etherpad gives the full pad to `sendfile()` the user will be relocated using this, so "`GET /static/custom`" triggers a
```Location: %2Fhome%2Fyvesf%2Fvcs%2Fetherpad-lite%2Fstatic%2Fcustom/```

In my opinion this path should not be revealed to the client side.