/ 
Jifty-1.01209
/ Jifty::Web::Form::Field::Uploads
Security Advisories (1)
CPANSA-Jifty-2011-01 (2011-03-17)

The path as passed in the fragment request data structure was used verbatim in the dispatcher and other locations. This possibly allowed requests to walk around ACLs by requesting '/some/safe/place/../../../dangerous' as a fragment.

NAME

Jifty::Web::Form::Field::Uploads - File uploads field

DESCRIPTION

An input field that renders using <input type="file" />. The argument value that the action receives from this field via "argument_value" in Jifty::Action will be a filehandle, which can be read in the usual ways.

render_widget

Renders the file upload widget.

render_value

The 'value', rendered, is empty so that BLOBs and the like don't get streamed to the browser.

classes

Add 'upload' to the rest of the classes