mention which methods do not protect from traversing to parent direct…

…ories
mojolicious · Sep 17, 2013 · 8e7f13d · 8e7f13d
1 parent 622d37f
commit 8e7f13d
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 5 deletions.
diff --git a/Changes b/Changes
@@ -1,4 +1,6 @@
 
+4.40  2013-09-18
+
 4.39  2013-09-17
   - Improved HTML5.1 compliance of Mojo::DOM::HTML.
 

diff --git a/lib/Mojolicious.pm b/lib/Mojolicious.pm
@@ -41,7 +41,7 @@ has static   => sub { Mojolicious::Static->new };
 has types    => sub { Mojolicious::Types->new };
 
 our $CODENAME = 'Top Hat';
-our $VERSION  = '4.39';
+our $VERSION  = '4.40';
 
 sub AUTOLOAD {
   my $self = shift;

diff --git a/lib/Mojolicious/Static.pm b/lib/Mojolicious/Static.pm
@@ -178,18 +178,24 @@ Serve static file for L<Mojolicious::Controller> object.
 
 =head2 file
 
-  my $asset = $static->file('foo/bar.html');
+  my $asset = $static->file('images/logo.png');
+  my $asset = $static->file('../lib/MyApp.pm');
 
 Get L<Mojo::Asset::File> or L<Mojo::Asset::Memory> object for a file, relative
-to C<paths> or from C<classes>.
+to C<paths> or from C<classes>. Note that this method does not protect from
+traversing to parent directories.
 
   my $content = $static->file('foo/bar.html')->slurp;
 
 =head2 serve
 
-  my $success = $static->serve(Mojolicious::Controller->new, 'foo/bar.html');
+  my $success =
+    $static->serve(Mojolicious::Controller->new, 'images/logo.png');
+  my $success =
+    $static->serve(Mojolicious::Controller->new, '../lib/MyApp.pm');
 
-Serve a specific file, relative to C<paths> or from C<classes>.
+Serve a specific file, relative to C<paths> or from C<classes>. Note that this
+method does not protect from traversing to parent directories.
 
 =head2 serve_asset