def get_options @error = 0 @options = {} @options[:url] = "/#{Fckeditor.config[:upload_dir]}/#{params[:Type]}/#{params[:CurrentFolder]}".gsub(/\/+/, '/') @options[:dir] = File.join('public', @options[:url]) @options[:dir] = @options[:url] if Dir.pwd.ends_with?('/public') end def sanitize_directory if params[:CurrentFolder] clean = File.expand_path(File.join(RAILS_ROOT, 'public', Fckeditor.config[:upload_dir])) dirty = File.expand_path(@options[:dir]) unless dirty.starts_with?(clean) render :nothing => true, :status => 403 false end end end