2 files changed, 8 insertions(+), 0 deletions(-)

M handlers/dir-index
M handlers/serve-static

@@ 1,6 1,10 @@
 #!/bin/rc
 full_path=`{echo $"fs_root^$"location | urlencode -d}
 full_path=$"full_path
+if(! ~ `{cleanname -d$fs_root $full_path} `{cleanname $fs_root}^*){
+	error 53 'path not allowed'
+	exit
+}
 
 echo '20 text/gemini'^$cr
 ls $full_path | sed '

@@ 1,6 1,10 @@
 #!/bin/rc
 full_path=`{echo $"fs_root^$"location | urlencode -d}
 full_path=$"full_path
+if(! ~ `{cleanname -d$fs_root $full_path} `{cleanname $fs_root}^*){
+	error 53 'path not allowed'
+	exit
+}
 
 if(! test -e $full_path){
 	error 51 'file does not exist'