Merge branch 'master' into lightning

2011-06-15 23:22:49 +02:00
parent 264bc66051 00d8b08341
commit 87a4a4e012
2 changed files with 15 additions and 1 deletions
--- a/radicale/ical.py
+++ b/radicale/ical.py
@ -183,7 +183,8 @@ class Calendar(object):
        The ``path`` is relative to the storage folder.

        """
-        attributes = posixpath.normpath(path.strip("/")).split("/")
+        # First do normpath and then strip, to prevent access to FOLDER/../
+        attributes = posixpath.normpath(path).strip("/").split("/")
        if not attributes:
            return None
        if attributes[-1].endswith(".ics"):