Roundup Tracker - Issues

Message5327

Author schlatterbeck
Recipients antmail, joseph_myers, schlatterbeck
Date 2015-06-23.07:28:09
Message-id <20150623072804.GB22197@runtux.com>
In-reply-to <1434981687.79.0.9139505228.issue2550891@psf.upfronthosting.co.za>
On Mon, Jun 22, 2015 at 02:01:27PM +0000, Anthony wrote:
> 
> There is no possibility to use subdir for templates in template store.
> 
> All templates have to be placed in flat template store. If you have many
> templates this may be a problem. 
> 
> The attached patch allow to use subdir in template store. For example,
> with this patch you can use "issue?@template=mobile/index" URL for
> "mobile/issue.index.html" template.

Have you considered this may have security implications if someone
specifies, e.g.,

issue?@template=../../../.....

You should check with abspath that the target is below the template
directory. (I haven't checked your code yet)

Ralf
-- 
Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:   http://www.runtux.com
Reichergasse 131, A-3411 Weidling       email: office@runtux.com
allmenda.com member                     email: rsc@allmenda.com
History
Date User Action Args
2015-06-23 07:28:10schlatterbecksetrecipients: + schlatterbeck, joseph_myers, antmail
2015-06-23 07:28:10schlatterbecklinkissue2550891 messages
2015-06-23 07:28:09schlatterbeckcreate