--- lib/twiki/Sandbox.pm_old Thu Jul 3 22:57:02 2008 +++ lib/twiki/Sandbox.pm Thu Jul 3 23:22:47 2008 @@ -142,15 +142,23 @@ sub normalizeFileName { my ($string) = @_; return '' unless $string; + + # SMELL On VMS, we store the filenames in UNIX syntax, so that + # parts of TWiki that assumes UNIX syntax will work. + # But currently File::Spec routines can not handle UNIX format on VMS + $string = VMS::Filespec::vmsify($string) if ($^O eq 'VMS'); + my ($volume, $dirs, $file) = File::Spec->splitpath($string); my @result; my $first = 1; + my $curdir = File::Spec->curdir; + my $updir = File::Spec->updir; foreach my $component (File::Spec->splitdir($dirs)) { next unless (defined($component) && $component ne '' || $first); $first = 0; $component ||= ''; - next if $component eq '.'; - if ($component eq '..') { + next if $component eq $curdir; + if ($component eq $updir) { throw Error::Simple( 'relative path in filename '.$string ); } elsif ($component =~ /$TWiki::cfg{NameFilter}/) { throw Error::Simple( 'illegal characters in file name component '. @@ -164,6 +172,10 @@ } else { $dirs = ''; } + + # SMELL File::Spec-catdir here is converting an absolute specification + # to a relative specification, so need to convert it back to absolute. + $dirs =~ s/^\[\./\[/ if ($^O eq 'VMS'); $string = File::Spec->catpath($volume, $dirs, $file); # We need to untaint the string explicitly.