From 3ab016870d507b5913caf980a272a8680cc2a38d Mon Sep 17 00:00:00 2001 From: Tom Preston-Werner Date: Mon, 22 Nov 2010 21:45:35 -0800 Subject: [PATCH] Prevent _includes dir from being a symlink. --- History.txt | 1 + lib/jekyll/tags/include.rb | 8 +++++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/History.txt b/History.txt index 6fc70e23..7969b2e3 100644 --- a/History.txt +++ b/History.txt @@ -9,6 +9,7 @@ * Bug Fixes * Fixed filename basename generation (#208) * Set mode to UTF8 on Sequel connections (#237) + * Prevent _includes dir from being a symlink == 0.7.0 / 2010-08-24 * Minor Enhancements diff --git a/lib/jekyll/tags/include.rb b/lib/jekyll/tags/include.rb index 0f159144..e71d07f7 100644 --- a/lib/jekyll/tags/include.rb +++ b/lib/jekyll/tags/include.rb @@ -7,11 +7,17 @@ module Jekyll end def render(context) + includes_dir = File.join(context.registers[:site].source, '_includes') + + if File.symlink?(includes_dir) + return "Includes directory '#{includes_dir}' cannot be a symlink" + end + if @file !~ /^[a-zA-Z0-9_\/\.-]+$/ || @file =~ /\.\// || @file =~ /\/\./ return "Include file '#{@file}' contains invalid characters or sequences" end - Dir.chdir(File.join(context.registers[:site].source, '_includes')) do + Dir.chdir(includes_dir) do choices = Dir['**/*'].reject { |x| File.symlink?(x) } if choices.include?(@file) source = File.read(@file)