sanitize urls and ignore symlinks

lib/jekyll/page.rb

@@ -55,14 +55,23 @@ module Jekyll
     #
     # Returns <String>
     def url
-      return permalink if permalink
+      return @url if @url
 
-      @url ||= {
+      url = if permalink
-        "basename"   => self.basename,
+        permalink
-        "output_ext" => self.output_ext,
+      else
-      }.inject(template) { |result, token|
+        {
-        result.gsub(/:#{token.first}/, token.last)
+          "basename"   => self.basename,
-      }.gsub(/\/\//, "/")
+          "output_ext" => self.output_ext,
+        }.inject(template) { |result, token|
+          result.gsub(/:#{token.first}/, token.last)
+        }.gsub(/\/\//, "/")
+      end
+
+      # sanitize url
+      @url = url.split('/').reject{ |part| part =~ /^\.+$/ }.join('/')
+      @url += "/" if url =~ /\/$/
+      @url
     end
 
     # Extract information from the page filename

lib/jekyll/post.rb

@@ -117,20 +117,29 @@ module Jekyll
     #
     # Returns <String>
     def url
-      return permalink if permalink
+      return @url if @url
 
-      @url ||= {
+      url = if permalink
-        "year"       => date.strftime("%Y"),
+        permalink
-        "month"      => date.strftime("%m"),
+      else
-        "day"        => date.strftime("%d"),
+        {
-        "title"      => CGI.escape(slug),
+          "year"       => date.strftime("%Y"),
-        "i_day"      => date.strftime("%d").to_i.to_s,
+          "month"      => date.strftime("%m"),
-        "i_month"    => date.strftime("%m").to_i.to_s,
+          "day"        => date.strftime("%d"),
-        "categories" => categories.join('/'),
+          "title"      => CGI.escape(slug),
-        "output_ext" => self.output_ext
+          "i_day"      => date.strftime("%d").to_i.to_s,
-      }.inject(template) { |result, token|
+          "i_month"    => date.strftime("%m").to_i.to_s,
-        result.gsub(/:#{Regexp.escape token.first}/, token.last)
+          "categories" => categories.join('/'),
-      }.gsub(/\/\//, "/")
+          "output_ext" => self.output_ext
+        }.inject(template) { |result, token|
+          result.gsub(/:#{Regexp.escape token.first}/, token.last)
+        }.gsub(/\/\//, "/")
+      end
+
+      # sanitize url
+      @url = url.split('/').reject{ |part| part =~ /^\.+$/ }.join('/')
+      @url += "/" if url =~ /\/$/
+      @url
     end
 
     # The UID for this post (useful in feeds)

lib/jekyll/site.rb

@@ -210,7 +210,7 @@ module Jekyll
     # Returns nothing
     def read_directories(dir = '')
       base = File.join(self.source, dir)
-      entries = filter_entries(Dir.entries(base))
+      entries = Dir.chdir(base){ filter_entries(Dir['*']) }
 
       self.read_posts(dir)
 
@@ -268,7 +268,10 @@ module Jekyll
     def filter_entries(entries)
       entries = entries.reject do |e|
         unless ['.htaccess'].include?(e)
-          ['.', '_', '#'].include?(e[0..0]) || e[-1..-1] == '~' || self.exclude.include?(e)
+          ['.', '_', '#'].include?(e[0..0]) ||
+          e[-1..-1] == '~' ||
+          self.exclude.include?(e) ||
+          File.symlink?(e)
         end
       end
     end