Skip to content

Conversation

@zoltan-mihalyi
Copy link

getTplPath returns a platform-dependent path, but it is compared to opts.baseDir with indexOf, resulting 403 errors when otps,basedir contains '/' characters.
Using path.relative check and checking whether the relative path starts with '.' ('..' means filepath is outside of baseDir) solves the problem.

@runk
Copy link
Owner

runk commented Feb 1, 2016

Should we check for ../ substring?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants