upstream path validation

.gitignore

@@ -5,10 +5,6 @@ dist/
 www/assets
 data/
 blib/
-nytprof/
-nytprof.out
-nytprof*
-www/nytprof
 pm_to_blib
 pod2htmd.tmp
 www/scripts/list.min.json
@@ -34,17 +30,3 @@ logs/
 run/
 *-shm
 *-wal
-service-files/*.service
-.ssh/*
-.bash_profile
-.bash_history
-.bashrc
-.cache/
-.gitconfig
-.viminfo
-.vimrc
-.tmux.conf
-.tig_history
-.sqlite_history
-.xslate_cache
-tCMS.log

lib/TCMS.pm

@@ -113,11 +113,6 @@ sub build_routes {
             # Now that we have firmed up the actual routing, let's validate.
             return $tpsgi->forbidden($query) if exists $query->{dispatcher}{auth} && !$active_user;
 
-            # Disallow any paths that are naughty ( starman auto-removes .. up-traversal)
-            if ( index( $query->{route}, '/templates' ) == 0 || index( $query->{route}, '/statics' ) == 0 || $query->{route} =~ m/.*(\.psgi|\.pm)$/i ) {
-                return $tpsgi->forbidden($query);
-            }
-
             no strict 'refs';
             $callback->($query);
             use strict;