lib/roda/plugins/render.rb in roda-2.23.0 vs lib/roda/plugins/render.rb in roda-2.24.0

- old
+ new

@@ -155,23 +155,26 @@ end # Setup default rendering options. See Render for details. def self.configure(app, opts=OPTS) if app.opts[:render] + orig_cache = app.opts[:render][:cache] opts = app.opts[:render][:orig_opts].merge(opts) end app.opts[:render] = opts.dup app.opts[:render][:orig_opts] = opts opts = app.opts[:render] opts[:engine] = (opts[:engine] || opts[:ext] || "erb").dup.freeze - opts[:views] = File.expand_path(opts[:views]||"views", app.opts[:root]).freeze + opts[:views] = app.expand_path(opts[:views]||"views").freeze opts[:allowed_paths] ||= [opts[:views]].freeze - opts[:allowed_paths] = opts[:allowed_paths].map{|f| ::File.expand_path(f)}.uniq.freeze + opts[:allowed_paths] = opts[:allowed_paths].map{|f| app.expand_path(f, nil)}.uniq.freeze if opts.fetch(:cache, true) - if cache_class = opts[:cache_class] + if orig_cache + opts[:cache] = orig_cache + elsif cache_class = opts[:cache_class] opts[:cache] = cache_class.new else opts[:cache] = app.thread_safe_cache end end @@ -394,10 +397,10 @@ # The template path for the given options. def template_path(opts) path = "#{opts[:views]}/#{template_name(opts)}.#{opts[:engine]}" if opts.fetch(:check_paths){render_opts[:check_paths]} - full_path = ::File.expand_path(path) + full_path = self.class.expand_path(path) unless render_opts[:allowed_paths].any?{|f| full_path.start_with?(f)} raise RodaError, "attempt to render path not in allowed_paths: #{path} (allowed: #{render_opts[:allowed_paths].join(', ')})" end end path