merge #5

build.properties

@@ -1,9 +1,9 @@
-#Fri, 23 May 2014 15:25:04 +0200
-build.time=15\:25\:04
-build.number=578
-build.date=Friday May 23, 2014
+#Thu, 05 Jun 2014 13:47:01 +0200
+build.time=13\:47\:01
+build.number=579
+build.date=Thursday Jun 05, 2014
 build.authorEmail=andrea@getrailo.org
 build.projectVersion=1.0.0
 build.year=2014
-build.timestamp=2014-05-23T15\:25\:04
+build.timestamp=2014-06-05T13\:47\:01
 build.author=Railo Technologies

build/tag/railo/core/ajax/JSLoader.cfc

@@ -1,21 +1,28 @@
-<cfcomponent>
+<cfcomponent output="false">
 
-	<!---Init--->
-	<cffunction name="init" output="false" returntype="void">
-		<cfreturn this />
-	</cffunction>
 
 	<!---get--->
-	<cffunction name="get" output="false" returntype="string" returnformat="plain" access="remote">
-		<cfargument name="lib" type="string" required="false" default="" />
-		<cfset var filePath = expandPath('js/#arguments.lib#.js')/>
-		<cfset var local = {result=""} /><cfcontent type="text/javascript">
-			<cfsavecontent variable="local.result">
-				<cfif fileExists(filePath)>                
-					<cfinclude template="js/#arguments.lib#.js"/>
-				</cfif>			
-			</cfsavecontent>		
-		<cfreturn local.result />	
+	<cffunction name="get" access="remote" output="false" returntype="string" returnformat="plain">
+		<cfargument name="lib" type="string">
+
+		<!--- restrict to files from JS directory !--->
+		<cfif arguments.lib CT "..">
+			<cfheader statuscode="400">
+			<cfreturn "// 400 - Bad Request">
+		</cfif>
+
+		<cfset var relPath = "js/#arguments.lib#.js">
+
+		<cfif fileExists( expandPath( relPath ) )>
+
+			<cfcontent type="text/javascript">
+			<cfsavecontent variable="local.result"><cfinclude template="#relPath#"></cfsavecontent>
+			<cfreturn result>
+		<cfelse>
+
+			<cfheader statuscode="404">
+			<cfreturn "// 404 - Not Found">
+		</cfif>
 	</cffunction>