fix security problem

app/controllers/announcements_controller.rb

@@ -499,6 +499,10 @@ class AnnouncementsController < ApplicationController
     @url = request.path
     begin
       file = BulletinFile.find(params[:id])
+      if File.basename(file.file.path) != URI.decode(params[:f_name])
+        render :file => "#{Rails.root}/app/views/errors/403.html", :layout => false, :status => :not_found, :content_type => 'text/html'
+        return
+      end
       @url = file.file.url
       if file.can_access?(OrbitHelper.current_user)
         @path = file.file.path rescue ""

config/routes.rb

@@ -39,7 +39,7 @@ Rails.application.routes.draw do
    get '/xhr/announcements/announcement.json', to: 'bulletins#get_bulletins'
    get '/xhr/panel/announcement/widget/sync_data' => 'announcements#show_widget'
    get '/xhr/announcements/:slug_title-:uid/comment', to: 'announcements#comment' 
-   get '/xhr/announcements/file/:id/*f_name' => 'announcements#get_file'
+   get '/xhr/announcements/file/:id/*f_name', to: 'announcements#get_file', format: false
   end
   
 end