diff options
author | Aaron Patterson <aaron.patterson@gmail.com> | 2016-01-20 10:39:19 -0800 |
---|---|---|
committer | Aaron Patterson <aaron.patterson@gmail.com> | 2016-01-22 15:02:27 -0800 |
commit | b7758b40fc035a47f6843158155606d455314c42 (patch) | |
tree | 92e2bdb231a7dda8902e0563bdc98867098c298a /actionview/lib/action_view/renderer/template_renderer.rb | |
parent | 0fde6f554b75b13b0435dd70f1c3ec02bc209e0d (diff) | |
download | rails-b7758b40fc035a47f6843158155606d455314c42.tar.gz rails-b7758b40fc035a47f6843158155606d455314c42.tar.bz2 rails-b7758b40fc035a47f6843158155606d455314c42.zip |
allow :file to be outside rails root, but anything else must be inside the rails view directory
CVE-2016-0752
Diffstat (limited to 'actionview/lib/action_view/renderer/template_renderer.rb')
-rw-r--r-- | actionview/lib/action_view/renderer/template_renderer.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/actionview/lib/action_view/renderer/template_renderer.rb b/actionview/lib/action_view/renderer/template_renderer.rb index 75217e1630..9d15bbfca7 100644 --- a/actionview/lib/action_view/renderer/template_renderer.rb +++ b/actionview/lib/action_view/renderer/template_renderer.rb @@ -29,7 +29,7 @@ module ActionView elsif options.key?(:html) Template::HTML.new(options[:html], formats.first) elsif options.key?(:file) - with_fallbacks { find_template(options[:file], nil, false, keys, @details) } + with_fallbacks { find_file(options[:file], nil, false, keys, @details) } elsif options.key?(:inline) handler = Template.handler_for_extension(options[:type] || "erb") Template.new(options[:inline], "inline template", handler, :locals => keys) |