1 files changed, 15 insertions, 11 deletions

diff --git a/app/controllers/content_controller.rb b/app/controllers/content_controller.rb
index 1b13456..c62b726 100644
--- a/app/controllers/content_controller.rb
+++ b/app/controllers/content_controller.rb
@@ -1,30 +1,30 @@
 class ContentController < ApplicationController
-  
+
   # Public
-  
+
   before_filter :find_page
-  
+
   # This is the method that renders most of the the public content. It recieves
-  # a :locale and a :page_path parameter through the params hash. It looks up 
+  # a :locale and a :page_path parameter through the params hash. It looks up
   # the node with the corresponding unique_name attribute. The method doesn't
-  # return a node though, the node is really a proxy object for pages. It 
+  # return a node though, the node is really a proxy object for pages. It
   # returns the most recent page associated to this node instead.
   def render_page
-    
+
     expires_in 20.minutes, :public => true
-    
+
     if @page and @page.public?
       render(
         :file => @page.valid_template,
         :layout => true
       )
     else
-      render( 
+      render(
         :file => File.join(RAILS_ROOT, 'public', '404.html'),
         :status => 404
       )
     end
-    
+
   end
 
   def render_gallery
@@ -35,10 +35,14 @@ class ContentController < ApplicationController
       render :nothing => true, :status => 404
     end
   end
-  
+
   private
     def find_page
       path = params[:page_path].join('/')
-      @page = Node.find_page(path)
+      if path =~ /^[a-zA-Z\:\/\/\.\-\d_]+$/
+        @page = Node.find_page(path)
+      else
+        @page = nil
+      end
     end
 end