Merge r24393 from trunk to 6.1-stable (#43690).

git-svn-id: https://svn.redmine.org/redmine/branches/6.1-stable@24395 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Marius Balteanu
2026-02-05 06:13:04 +00:00
parent 0d4b2052dd
commit 042cf82180

View File

@@ -111,7 +111,7 @@ module Redmine
# Here we do not shell-out, so we do not want quotes.
def target(path=nil)
# Prevent the use of ..
if path and !/(^|\/)\.\.(\/|$)/.match?(path)
if path and !/(^|[\/\\])\.\.([\/\\]|$)/.match?(path)
return "#{self.url}#{without_leading_slash(path)}"
end