admin_data 1.1.1 → 1.1.2

data/app/controllers/admin_data/public_controller.rb

@@ -3,12 +3,16 @@ module AdminData
 
     def serve
 
-      # validate filename with a white list
-      unless self.class.admin_data_assets.include? params[:file]
+
+      path = File.join(AdminData.public_dir,params[:file])
+      expanded_path = File.expand_path(path)
+
+      # validate that expanded path has admin_data
+      unless expanded_path =~ /admin_data/
         render :nothing => true, :status => 404 and return
       end
 
-      opts = {:text => File.read(File.join(AdminData.public_dir,params[:file])), :cache => true}
+      opts = {:text => File.read(path), :cache => true}
 
       case params[:file]
       when /\.css$/i then opts[:content_type] = "text/css"
@@ -21,17 +25,6 @@ module AdminData
       render opts
     end
 
-    protected
-
-    # Cached list of all assets provided by admin_data
-    # It is used to ensure security in the serve method
-    def self.admin_data_assets
-      @admin_data_assets ||= (
-        Dir.glob(File.join(AdminData.public_dir, '**', '*')).map do |path|
-           # we want only relative paths
-           path.split(AdminData.public_dir, 2).last
-        end
-      )
-    end
+
   end
 end

data/lib/admin_data/version.rb

@@ -1,3 +1,3 @@
 module AdminData
-  VERSION = '1.1.1'
+  VERSION = '1.1.2'
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: admin_data
 version: !ruby/object:Gem::Version 
-  hash: 17
+  hash: 23
   prerelease: false
   segments: 
   - 1
   - 1
-  - 1
-  version: 1.1.1
+  - 2
+  version: 1.1.2
 platform: ruby
 authors: 
 - Neeraj Singh