Changeset 1770

Timestamp:

2008-03-22 11:59:58 (3 months ago)

Author:

fredck

Message:

[ASP.NET] Fixed #1944 : The "\" character is now blocked in the currentFolder parameter.

Location:

FCKeditor.Net/trunk

Files:

• FileBrowser/Connector.cs (modified) (2 diffs)
• _whatsnew.html (modified) (1 diff)

FCKeditor.Net/trunk/FileBrowser/Connector.cs

@@ -38 +38 @@
                         if ( !Config.Enabled )
                         {
-                                XmlResponseHandler.SendError( Response, 1, "This connector is disabled. Please check the \"editor/filemanager/connectors/aspx/config.aspx\" file." );
+                                XmlResponseHandler.SendError( Response, 1, "This connector is disabled. Please check the \"editor/filemanager/connectors/aspx/config.ascx\" file." );
                                 return;
                         }
@@ -67 +67 @@
 
                         // Check for invalid folder paths (..).
-                        if ( sCurrentFolder.IndexOf( ".." ) >= 0 )
+                        if ( sCurrentFolder.IndexOf( ".." ) >= 0 || sCurrentFolder.IndexOf( "\\" ) >= 0 )
                         {
                                 XmlResponseHandler.SendError( Response, 102, "" );

FCKeditor.Net/trunk/_whatsnew.html

@@ -40 +40 @@
                 <li>[<a target="_blank" href="http://dev.fckeditor.net/ticket/1945">#1945</a>] New folders
                         and file names are now properly sanitized against control characters.</li>
+                <li>[<a target="_blank" href="http://dev.fckeditor.net/ticket/1944">#1944</a>] The "\"
+                        character is now properly verified for all connector requests.</li>
         </ul>
         <h3>