This appears to stop the gitalist on goatse assploading
Tomas Doran [Mon, 7 Dec 2009 21:38:32 +0000 (21:38 +0000)]
lib/Gitalist/Git/Repo.pm

index b31faff..6552287 100644 (file)
@@ -67,6 +67,8 @@ name.
 
     method project (NonEmptySimpleStr $project) {
         my $path = $self->repo_dir->subdir($project)->resolve;
+        $self->repo_dir->resolve; # FIXME - This needs to be called, or if repo_dir contains .., it'll explode below!
+                                  #         This is a Path::Class::Dir bug, right?
         die "Directory traversal prohibited" unless $self->repo_dir->contains($path);
         die "Not a valid Project" unless $self->_is_git_repo($path);
         return Project->new( $self->repo_dir->subdir($project) );