Class: Storytime::Constraints::PageConstraint

Inherits:
Object
  • Object
show all
Includes:
Storytime::Concerns::CurrentSite
Defined in:
lib/storytime/constraints/page_constraint.rb

Instance Method Summary collapse

Methods included from Storytime::Concerns::CurrentSite

#current_storytime_site

Instance Method Details

#matches?(request) ⇒ Boolean

Returns:

  • (Boolean) 


6
7
8
9
10
11
12
13
14
15
16
 
# File 'lib/storytime/constraints/page_constraint.rb', line 6

def matches?(request)
  id = request.params[:id].to_s
  # Reject path traversal: params[:id] comes from the "/*id" glob route, so it
  # can contain "/" and ".." segments. sanitize() only strips HTML, not "../",
  # which would let the File.exist? below probe arbitrary filesystem paths
  return false if id.include?("..")

  site = current_storytime_site(request)
  site.pages.friendly.exists?(id) ||
  File.exist?(Rails.root.join('app', 'views', "storytime/#{site.custom_view_path}/pages/#{ActionController::Base.helpers.sanitize(id)}.html.erb"))
end