From 1b5bb58c8d67c81f8caf52e2c6a956a71c4aee47 Mon Sep 17 00:00:00 2001
From: rulingcom <orbit@rulingcom.com>
Date: Sat, 24 Oct 2026 17:09:45 +0800
Subject: [PATCH] Restrict ruling template upload paths to template PSD files

---
 app/controllers/admin/ruling_templates_controller.rb | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/app/controllers/admin/ruling_templates_controller.rb b/app/controllers/admin/ruling_templates_controller.rb
index 4131772..d82077c 100644
--- a/app/controllers/admin/ruling_templates_controller.rb
+++ b/app/controllers/admin/ruling_templates_controller.rb
@@ -60,7 +60,12 @@ class Admin::RulingTemplatesController < OrbitAdminController
   end
 
   def upload_temp_file
-    filepath = params[:path]
+    filepath = File.expand_path(params[:path].to_s)
+    allowed_psd_path = TemplatePsdFile.all.any? { |p| p.psd_zip.path.present? && File.expand_path(p.psd_zip.path) == filepath }
+    unless allowed_psd_path
+      render :json => {"success" => false}.to_json
+      return
+    end
     file = params[:psdfile]
     File.open(filepath,"ab"){ |f| f.write(file.read) }
     render :json => {"success" => true}.to_json
@@ -70,7 +75,7 @@ class Admin::RulingTemplatesController < OrbitAdminController
     dirname = Digest::MD5.hexdigest(Time.now.to_s)
     directory = "public/ruling_template/#{dirname}"
     FileUtils.mkdir_p(directory) unless File.exists?(directory)
-    path_to_file = "#{directory}/#{params[:filename]}"
+    path_to_file = "#{directory}/#{File.basename(params[:filename].to_s)}"
     File.open(path_to_file,"w")
     template = RTemplate.find(params[:id])
     if !template.template_psd_file.nil? && !template.template_psd_file.psd_zip.url.nil?