diff --git a/lib/Cake/Test/Case/View/ViewTest.php b/lib/Cake/Test/Case/View/ViewTest.php index f18a02093b9..a283086e45a 100644 --- a/lib/Cake/Test/Case/View/ViewTest.php +++ b/lib/Cake/Test/Case/View/ViewTest.php @@ -395,6 +395,26 @@ public function testGetTemplate() { $this->assertEquals($expected, $result); } +/** + * Test that plugin files with absolute file paths are scoped + * to the plugin and do now allow any file path. + * + * @expectedException MissingViewException + * @return void + */ + public function testPluginGetTemplateAbsoluteFail() { + $this->Controller->viewPath = 'Pages'; + $this->Controller->action = 'display'; + $this->Controller->params['pass'] = array('home'); + + $view = new TestThemeView($this->Controller); + $expected = CAKE . 'Test' . DS . 'test_app' . DS . 'Plugin' . DS . 'Company' . DS . 'TestPluginThree' . DS . 'View' . DS . 'Pages' . DS . 'index.ctp'; + $result = $view->getViewFileName('Company/TestPluginThree./Pages/index'); + $this->assertPathEquals($expected, $result); + + $view->getViewFileName('Company/TestPluginThree./etc/passwd'); + } + /** * Test getLayoutFileName method on plugin * diff --git a/lib/Cake/View/View.php b/lib/Cake/View/View.php index a33dd1a1ffd..61d2fcd56f5 100644 --- a/lib/Cake/View/View.php +++ b/lib/Cake/View/View.php @@ -1002,9 +1002,6 @@ protected function _getViewFileName($name = null) { $name = $this->viewPath . DS . $subDir . Inflector::underscore($name); } elseif (strpos($name, DS) !== false) { if ($name[0] === DS || $name[1] === ':') { - if (is_file($name)) { - return $name; - } $name = trim($name, DS); } elseif ($name[0] === '.') { $name = substr($name, 3);