lib/dashing.rb in dashing-1.0.3 vs lib/dashing.rb in dashing-1.0.4

@@ -47,11 +47,15 @@
   end
 end
 
 get '/:dashboard' do
   protected!
-  erb params[:dashboard].to_sym
+  if File.exist? File.join(settings.views, "#{params[:dashboard]}.erb")
+    erb params[:dashboard].to_sym
+  else
+    halt 404
+  end
 end
 
 get '/views/:widget?.html' do
   protected!
   widget = params[:widget]
@@ -67,9 +71,13 @@
     204 # response without entity body
   else
     status 401
     "Invalid API key\n"
   end
+end
+
+not_found do
+  send_file File.join(settings.public_folder, '404.html')
 end
 
 def development?
   ENV['RACK_ENV'] == 'development'
 end