Lockdown access to custom css and js files in repo

2018-10-02 23:31:07 +02:00
parent b1cdf91789
commit c85e14336e
2 changed files with 30 additions and 0 deletions
@@ -144,6 +144,10 @@ module Precious
      end
    end

+    get %r{\/edit\/custom.(js|css)} do
+      forbid
+    end
+
    get '/edit/*' do
      forbid unless @allow_editing
      wikip = wiki_page(params[:splat].first)
@@ -212,6 +216,10 @@ module Precious
      end
    end

+    post %r{\/(deleteFile|rename|edit|revert)\/custom.(js|css)} do
+      forbid
+    end
+
    post '/deleteFile/*' do
      forbid unless @allow_editing
      wiki = wiki_new