Merge remote-tracking branch 'origin/v13'

geddy · Oct 10, 2015 · d38cc32 · d38cc32
2 parents 6e2207d + c963a88
commit d38cc32
Show file tree

Hide file tree

Showing 5 changed files with 14 additions and 4 deletions.
diff --git a/.travis.yml b/.travis.yml
@@ -4,6 +4,8 @@ node_js:
   - "0.10"
   - "iojs"
 
+sudo: false
+
 before_install:
   - npm update -g npm
 

diff --git a/README.md b/README.md
@@ -1,7 +1,7 @@
 # Geddy
 #### A simple, structured web framework for Node
 
-[![Build Status](https://travis-ci.org/geddy/geddy.png?branch=master)](https://travis-ci.org/geddy/geddy)
+[![Build Status](https://travis-ci.org/geddy/geddy.png?branch=master)](https://travis-ci.org/geddy/geddy) [![Gitter](https://badges.gitter.im/Join Chat.svg)](https://gitter.im/geddy/geddy)
 
 #### Install Geddy:
 
@@ -44,7 +44,7 @@ https://www.digitalocean.com/community/articles/geddy-js-a-no-brainer-mvc-node-j
 #### Community
 
 * Mailing list: [https://groups.google.com/group/geddyjs](https://groups.google.com/group/geddyjs)
-* IRC: #geddy on Freenode
+* [Gitter](https://gitter.im/geddy/geddy)
 
 #### License
 

diff --git a/lib/app/index.js b/lib/app/index.js
@@ -179,7 +179,14 @@
 
 
       // Get the path to the file, decoding the request URI
-      staticPath = this.config.staticFilePath + decodeURIComponent(reqUrl);
+      staticPath = path.resolve(path.join(this.config.staticFilePath, decodeURIComponent(reqUrl)));
+
+      // Prevent directory traversal
+      if (staticPath.indexOf(this.config.staticFilePath) !== 0) {
+        this.handleNotFound(reqUrl, params, reqObj, respObj);
+        return;
+      }
+
       // Ignore querystring
       staticPath = staticPath.split('?')[0];
 

diff --git a/lib/init/mailer.js b/lib/init/mailer.js
@@ -8,6 +8,7 @@
       var cfg = app.config.mailer
         , mailer
         , msg
+        , plugin
         , transport;
       if (cfg) {
         msg = 'Geddy mailer support requires Nodemailer. Try `npm install nodemailer`.';

diff --git a/package.json b/package.json
@@ -8,7 +8,7 @@
     "MVC",
     "realtime"
   ],
-  "version": "13.0.7",
+  "version": "13.0.8",
   "author": "Matthew Eernisse <mde@fleegix.org> (http://fleegix.org)",
   "dependencies": {
     "barista": "0.2.x",