From ee1e5798ec331ed4234a797db1ca32f1769fe2b6 Mon Sep 17 00:00:00 2001
From: "asasaki%mozilla.com"
 <asasaki%mozilla.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Wed, 20 Feb 2013 07:10:48 +0000
Subject: [PATCH] bug 842742 - don't allow '..' in logfile. r=justdave

git-svn-id: svn://10.0.0.236/trunk@264780 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/tinderbox/showlog.cgi | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mozilla/webtools/tinderbox/showlog.cgi b/mozilla/webtools/tinderbox/showlog.cgi
index d75dcce8798..497cd9ef2c1 100755
--- a/mozilla/webtools/tinderbox/showlog.cgi
+++ b/mozilla/webtools/tinderbox/showlog.cgi
@@ -72,6 +72,10 @@ if (defined($args = $form{log}) or defined($args = $form{exerpt})) {
   $logfile     = shell_escape($form{logfile});
   $buildname   = $form{buildname};
   $buildtime   = $form{buildtime};
+  # bug 842742
+  if ($logfile =~ /\.\./) {
+    die "Illegal logfile parameter $logfile";
+  }
 }
 $fulltext    = $form{fulltext};