Restrict ruling template upload paths to template PSD files

app/controllers/admin/ruling_templates_controller.rb

@@ -60,7 +60,12 @@ class Admin::RulingTemplatesController < OrbitAdminController
   end
 
   def upload_temp_file
-    filepath = params[:path]
+    filepath = File.expand_path(params[:path].to_s)
+    allowed_psd_path = TemplatePsdFile.all.any? { |p| p.psd_zip.path.present? && File.expand_path(p.psd_zip.path) == filepath }
+    unless allowed_psd_path
+      render :json => {"success" => false}.to_json
+      return
+    end
     file = params[:psdfile]
     File.open(filepath,"ab"){ |f| f.write(file.read) }
     render :json => {"success" => true}.to_json
@@ -70,7 +75,7 @@ class Admin::RulingTemplatesController < OrbitAdminController
     dirname = Digest::MD5.hexdigest(Time.now.to_s)
     directory = "public/ruling_template/#{dirname}"
     FileUtils.mkdir_p(directory) unless File.exists?(directory)
-    path_to_file = "#{directory}/#{params[:filename]}"
+    path_to_file = "#{directory}/#{File.basename(params[:filename].to_s)}"
     File.open(path_to_file,"w")
     template = RTemplate.find(params[:id])
     if !template.template_psd_file.nil? && !template.template_psd_file.psd_zip.url.nil?