diff --git a/app/controllers/announcements_controller.rb b/app/controllers/announcements_controller.rb index ea21325..40c3235 100644 --- a/app/controllers/announcements_controller.rb +++ b/app/controllers/announcements_controller.rb @@ -497,7 +497,10 @@ class AnnouncementsController < ApplicationController end def get_file @url = request.path - render :file => "#{Rails.root}/app/views/errors/404.html", :layout => false, :status => :not_found, :content_type => 'text/html' and return if @url.match(/\/\.\./) + if @url.match(/\/\.\./) + render :file => "#{Rails.root}/app/views/errors/404.html", :layout => false, :status => :not_found, :content_type => 'text/html' + return + end begin file = BulletinFile.find(params[:id]) if File.basename(file.file.path) != URI.decode(params[:f_name])