|
 |
12d00a |
From 5c656a271a890cca4b3d438cc1fc76ff98011cbe Mon Sep 17 00:00:00 2001
|
|
|
12d00a |
From: Aaron Patterson <aaron.patterson@gmail.com>
|
|
|
12d00a |
Date: Wed, 20 Jan 2016 10:39:19 -0800
|
|
|
12d00a |
Subject: [PATCH] allow :file to be outside rails root, but anything else must
|
|
|
12d00a |
be inside the rails view directory
|
|
|
12d00a |
|
|
|
12d00a |
Conflicts:
|
|
|
12d00a |
actionpack/test/controller/render_test.rb
|
|
|
12d00a |
actionview/lib/action_view/template/resolver.rb
|
|
|
12d00a |
|
|
|
12d00a |
CVE-2016-0752
|
|
|
12d00a |
---
|
|
|
12d00a |
actionpack/lib/abstract_controller/rendering.rb | 8 +++++-
|
|
|
12d00a |
actionpack/test/controller/render_test.rb | 31 ++++++++++++++++++++++
|
|
|
12d00a |
actionview/lib/action_view/lookup_context.rb | 4 +++
|
|
|
12d00a |
actionview/lib/action_view/path_set.rb | 26 +++++++++++++-----
|
|
|
12d00a |
.../lib/action_view/renderer/abstract_renderer.rb | 2 +-
|
|
|
12d00a |
.../lib/action_view/renderer/template_renderer.rb | 2 +-
|
|
|
12d00a |
actionview/lib/action_view/template/resolver.rb | 25 ++++++++++++++---
|
|
|
12d00a |
actionview/lib/action_view/testing/resolvers.rb | 4 +--
|
|
|
12d00a |
actionview/test/template/render_test.rb | 7 +++++
|
|
|
12d00a |
9 files changed, 93 insertions(+), 16 deletions(-)
|
|
|
12d00a |
|
|
|
12d00a |
diff --git a/actionview/test/template/render_test.rb b/actionview/test/template/render_test.rb
|
|
|
12d00a |
index 1316f85..caf6d13 100644
|
|
|
12d00a |
--- a/actionview/test/template/render_test.rb
|
|
|
12d00a |
+++ b/actionview/test/template/render_test.rb
|
|
|
12d00a |
@@ -142,6 +142,13 @@ module RenderTestCases
|
|
|
12d00a |
assert_equal "only partial", @view.render("test/partial_only")
|
|
|
12d00a |
end
|
|
|
12d00a |
|
|
|
12d00a |
+ def test_render_outside_path
|
|
|
12d00a |
+ assert File.exist?(File.join(File.dirname(__FILE__), '../../test/abstract_unit.rb'))
|
|
|
12d00a |
+ assert_raises ActionView::MissingTemplate do
|
|
|
12d00a |
+ @view.render(:template => "../\\../test/abstract_unit.rb")
|
|
|
12d00a |
+ end
|
|
|
12d00a |
+ end
|
|
|
12d00a |
+
|
|
|
12d00a |
def test_render_partial
|
|
|
12d00a |
assert_equal "only partial", @view.render(:partial => "test/partial_only")
|
|
|
12d00a |
end
|
|
|
12d00a |
--
|
|
|
12d00a |
2.2.1
|
|
|
12d00a |
|