fix vulnerability

app/controllers/announcements_controller.rb

@@ -497,6 +497,7 @@ class AnnouncementsController < ApplicationController
   end
   def get_file
     @url = request.path
+    render :text => "Path not allow",:status => 404 if @url.match(/\/\.\./)
     begin
       file = BulletinFile.find(params[:id])
       if File.basename(file.file.path) != URI.decode(params[:f_name])