Some cleanup and sec.

Web/lib/MJB/Web/Controller/Dashboard.pm

@@ -21,12 +21,20 @@ sub blog_post_edit ( $c ) {
     my $blog = $c->stash->{blog};
 
     my $post = $c->stash->{post} = $c->jekyll($blog->domain->name)->get_post( $c->param('mdfile') );
+
+    if ( ! $post ) {
+        $c->redirect_to( $c->url_for( 'show_dashboard_blog_posts', { id => $blog->id } ) );
+    }
 }
 
 sub blog_post_alter ( $c ) {
     my $blog = $c->stash->{blog};
 
     my $post = $c->stash->{post} = $c->jekyll($blog->domain->name)->get_post( $c->param('mdfile') );
+
+    if ( ! $post ) {
+        $c->redirect_to( $c->url_for( 'show_dashboard_blog_posts', { id => $blog->id } ) );
+    }
 }
 
 sub do_blog_post_remove ( $c ) {
@@ -264,6 +272,10 @@ sub blog_page_edit ( $c ) {
     my $rel_path = $c->param('file');
 
     ( $c->stash->{blog_page} ) = grep { $_->rel_path eq $rel_path } @{$blog_pages};
+    
+    if ( ! $c->stash->{blog_page} ) {
+        $c->redirect_to( $c->url_for( 'show_dashboard_blog_pages', { id => $blog->id } ) );
+    }
 
 }
 
@@ -299,6 +311,11 @@ sub do_blog_page_edit ( $c ) {
     my $headers  = $c->param('pageHeaders');
 
     my ( $blog_page ) = grep { $_->rel_path eq $rel_path } @{$blog_pages};
+    
+    if ( ! $c->stash->{blog_page} ) {
+        $c->redirect_to( $c->url_for( 'show_dashboard_blog_pages', { id => $blog->id } ) );
+        return;
+    }
 
     $blog_page->set_headers_from_string( $headers );
     $blog_page->markdown( $content );

libs/MJB-Backend-Jekyll/lib/MJB/Backend/Jekyll.pm

@@ -178,6 +178,12 @@ sub list_pages {
 sub get_post {
     my ( $self, $filename ) = @_;
 
+    return undef
+        if $filename =~ m|\.\./|;
+
+    return undef
+        unless -f $self->repo_path . "/_posts/" . $filename;
+
     return MJB::Backend::Jekyll::MarkdownFile->new(
         root => $self->repo_path,
         path => $self->repo_path . "/_posts/" . $filename,
@@ -187,6 +193,9 @@ sub get_post {
 
 sub new_post {
     my ( $self, $filename ) = @_;
+    
+    return undef
+        if $filename =~ m|\.\./|;
 
     return MJB::Backend::Jekyll::MarkdownFile->new(
         root => $self->repo_path,
@@ -196,6 +205,9 @@ sub new_post {
 
 sub new_page {
     my ( $self, $filename ) = @_;
+    
+    return undef
+        if $filename =~ m|\.\./|;
 
     return MJB::Backend::Jekyll::MarkdownFile->new(
         root => $self->repo_path,