From 16cb4bb724d4183e283ca5a995064ec34baa5ada Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Fri, 31 Jul 2026 13:46:17 +0200
Subject: Restrict editor provided partial names to alphanum(/alphanum)?

---
 app/helpers/content_helper.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'app')

diff --git a/app/helpers/content_helper.rb b/app/helpers/content_helper.rb
index 935ed7b8..57f8c960 100644
--- a/app/helpers/content_helper.rb
+++ b/app/helpers/content_helper.rb
@@ -149,7 +149,7 @@ module ContentHelper
   # Either return a custom partial path if it exsits or default to the standard
   # partial
   def select_partial partial
-    if partial && partial_exists?( partial )
+    if partial.to_s.match?(%r{\A[a-z0-9_]+(/[a-z0-9_]+)?\z}) && partial_exists?( partial )
       return "custom/partials/#{partial}"
     else
       return 'custom/partials/article'
-- 
cgit v1.3