diff options
| author | erdgeist <erdgeist@erdgeist.org> | 2026-07-31 13:46:17 +0200 |
|---|---|---|
| committer | erdgeist <erdgeist@erdgeist.org> | 2026-07-31 13:46:17 +0200 |
| commit | 16cb4bb724d4183e283ca5a995064ec34baa5ada (patch) | |
| tree | 2332effc65c025311e516a8a6016f89d4c2183f3 | |
| parent | de21b8622702adb7036babc88c4f6cfa62576161 (diff) | |
Restrict editor provided partial names to alphanum(/alphanum)?
| -rw-r--r-- | app/helpers/content_helper.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/app/helpers/content_helper.rb b/app/helpers/content_helper.rb index 935ed7b8..57f8c960 100644 --- a/app/helpers/content_helper.rb +++ b/app/helpers/content_helper.rb | |||
| @@ -149,7 +149,7 @@ module ContentHelper | |||
| 149 | # Either return a custom partial path if it exsits or default to the standard | 149 | # Either return a custom partial path if it exsits or default to the standard |
| 150 | # partial | 150 | # partial |
| 151 | def select_partial partial | 151 | def select_partial partial |
| 152 | if partial && partial_exists?( partial ) | 152 | if partial.to_s.match?(%r{\A[a-z0-9_]+(/[a-z0-9_]+)?\z}) && partial_exists?( partial ) |
| 153 | return "custom/partials/#{partial}" | 153 | return "custom/partials/#{partial}" |
| 154 | else | 154 | else |
| 155 | return 'custom/partials/article' | 155 | return 'custom/partials/article' |