Merge pull request #1069 from repotag/master

Added security check.
2015-09-20 14:31:14 +02:00
parent 288f75929d ce68a88293
commit de5aed2f6a
1 changed files with 1 additions and 0 deletions
@@ -176,6 +176,7 @@ module Precious
        fullname = params[:file][:filename]
        tempfile = params[:file][:tempfile]
      end
+      halt 500 unless tempfile.is_a? Tempfile

      # Remove page file dir prefix from upload path if necessary -- committer handles this itself
      dir      = wiki.per_page_uploads ? params[:upload_dest].match(/^(#{wiki.page_file_dir}\/+)?(.*)/)[2] : 'uploads'