diff options
author | Rafael Mendonça França <rafaelmfranca@gmail.com> | 2014-04-17 16:50:39 -0300 |
---|---|---|
committer | Rafael Mendonça França <rafaelmfranca@gmail.com> | 2014-05-05 11:37:34 -0300 |
commit | 0f3b7d1a319383f743f9938e1eed00f0fba7a367 (patch) | |
tree | 57e8072a1d25458442a9cec90bd687dedf271f9b /actionpack/lib/action_controller/railties/paths.rb | |
parent | 666e9f65bdfeb6cc5aa80b6254608adc3d7845ce (diff) | |
download | rails-0f3b7d1a319383f743f9938e1eed00f0fba7a367.tar.gz rails-0f3b7d1a319383f743f9938e1eed00f0fba7a367.tar.bz2 rails-0f3b7d1a319383f743f9938e1eed00f0fba7a367.zip |
Only accept actions without File::SEPARATOR in the name.
This will avoid directory traversal in implicit render.
Fixes: CVE-2014-0130
Diffstat (limited to 'actionpack/lib/action_controller/railties/paths.rb')
0 files changed, 0 insertions, 0 deletions