mirror of
https://github.com/redmine/redmine.git
synced 2026-05-05 22:36:04 +02:00
Merge r24393 from trunk to 5.1-stable (#43690).
git-svn-id: https://svn.redmine.org/redmine/branches/5.1-stable@24474 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
@@ -112,7 +112,7 @@ module Redmine
|
||||
# Here we do not shell-out, so we do not want quotes.
|
||||
def target(path=nil)
|
||||
# Prevent the use of ..
|
||||
if path and !/(^|\/)\.\.(\/|$)/.match?(path)
|
||||
if path and !/(^|[\/\\])\.\.([\/\\]|$)/.match?(path)
|
||||
return "#{self.url}#{without_leading_slash(path)}"
|
||||
end
|
||||
|
||||
|
||||
Reference in New Issue
Block a user