- Fixed a bug occuring if the "curdir" CGI parameter had no trailing slash and

  the "newfile" parameter had no leading slash
- On Windows systems it was possible to access the directories above the root
  directory by accessing a path ending with "..." or "...." and so on

diff --git a/devedit.pl b/devedit.pl
index 4ddc9e1a3c04dbf2d2a92a0fa82c3faf1a9a7c17..ee4f5fc09011133b3773f771ab7c1de78773b281 100644 (file)
--- a/devedit.pl
+++ b/devedit.pl
@@ -60,7 +60,7 @@ my $new_virtual  = '';
 if($newfile ne '' && $newfile !~ /^\s+$/)
 {
  $curdir  = upper_path($file) if($curdir eq '');
- my $path = $curdir.$newfile;
+ my $path = $curdir.'/'.$newfile;
 
  # Extract file and directory name...
 

diff --git a/modules/Tool.pm b/modules/Tool.pm
index e3056c590ee39fa929eafaa62751e7ea522504e4..dc1157159e51b19cf193974f5ed89afd8c69ff58 100644 (file)
--- a/modules/Tool.pm
+++ b/modules/Tool.pm
@@ -72,7 +72,7 @@ sub check_path($$)
  # Check if the path is above the root directory
 
  return if(index($path,$root) != 0);
- return if($first eq $root && $last =~ m!^(/|\\)?\.\.(/|\\)?$!);
+ return if($first eq $root && ($last eq '..' || ($^O eq 'MSWin32' && $last =~ m!^\.\.+$!)));
 
  # Create short path name