diff --git a/History.txt b/History.txt index 6fc70e23..7969b2e3 100644 --- a/History.txt +++ b/History.txt @@ -9,6 +9,7 @@ * Bug Fixes * Fixed filename basename generation (#208) * Set mode to UTF8 on Sequel connections (#237) + * Prevent _includes dir from being a symlink == 0.7.0 / 2010-08-24 * Minor Enhancements diff --git a/lib/jekyll/tags/include.rb b/lib/jekyll/tags/include.rb index 0f159144..e71d07f7 100644 --- a/lib/jekyll/tags/include.rb +++ b/lib/jekyll/tags/include.rb @@ -7,11 +7,17 @@ module Jekyll end def render(context) + includes_dir = File.join(context.registers[:site].source, '_includes') + + if File.symlink?(includes_dir) + return "Includes directory '#{includes_dir}' cannot be a symlink" + end + if @file !~ /^[a-zA-Z0-9_\/\.-]+$/ || @file =~ /\.\// || @file =~ /\/\./ return "Include file '#{@file}' contains invalid characters or sequences" end - Dir.chdir(File.join(context.registers[:site].source, '_includes')) do + Dir.chdir(includes_dir) do choices = Dir['**/*'].reject { |x| File.symlink?(x) } if choices.include?(@file) source = File.read(@file)