Some cleanup and sec.

Web/lib/MJB/Web/Controller/Dashboard.pm

@@ -21,12 +21,20 @@ sub blog_post_edit ( $c ) {
     my $blog = $c->stash->{blog};
 
     my $post = $c->stash->{post} = $c->jekyll($blog->domain->name)->get_post( $c->param('mdfile') );
+
+    if ( ! $post ) {
+        $c->redirect_to( $c->url_for( 'show_dashboard_blog_posts', { id => $blog->id } ) );
+    }
 }
 
 sub blog_post_alter ( $c ) {
     my $blog = $c->stash->{blog};
 
     my $post = $c->stash->{post} = $c->jekyll($blog->domain->name)->get_post( $c->param('mdfile') );
+
+    if ( ! $post ) {
+        $c->redirect_to( $c->url_for( 'show_dashboard_blog_posts', { id => $blog->id } ) );
+    }
 }
 
 sub do_blog_post_remove ( $c ) {
@@ -265,6 +273,10 @@ sub blog_page_edit ( $c ) {
 
     ( $c->stash->{blog_page} ) = grep { $_->rel_path eq $rel_path } @{$blog_pages};
     
+    if ( ! $c->stash->{blog_page} ) {
+        $c->redirect_to( $c->url_for( 'show_dashboard_blog_pages', { id => $blog->id } ) );
+    }
+
 }
 
 sub do_blog_page_remove ( $c ) {
@@ -300,6 +312,11 @@ sub do_blog_page_edit ( $c ) {
 
     my ( $blog_page ) = grep { $_->rel_path eq $rel_path } @{$blog_pages};
     
+    if ( ! $c->stash->{blog_page} ) {
+        $c->redirect_to( $c->url_for( 'show_dashboard_blog_pages', { id => $blog->id } ) );
+        return;
+    }
+
     $blog_page->set_headers_from_string( $headers );
     $blog_page->markdown( $content );
 

libs/MJB-Backend-Jekyll/lib/MJB/Backend/Jekyll.pm

@@ -178,6 +178,12 @@ sub list_pages {
 sub get_post {
     my ( $self, $filename ) = @_;
 
+    return undef
+        if $filename =~ m|\.\./|;
+
+    return undef
+        unless -f $self->repo_path . "/_posts/" . $filename;
+
     return MJB::Backend::Jekyll::MarkdownFile->new(
         root => $self->repo_path,
         path => $self->repo_path . "/_posts/" . $filename,
@@ -188,6 +194,9 @@ sub get_post {
 sub new_post {
     my ( $self, $filename ) = @_;
     
+    return undef
+        if $filename =~ m|\.\./|;
+
     return MJB::Backend::Jekyll::MarkdownFile->new(
         root => $self->repo_path,
         path => $self->repo_path . "/_posts/" . $filename,
@@ -197,6 +206,9 @@ sub new_post {
 sub new_page {
     my ( $self, $filename ) = @_;
     
+    return undef
+        if $filename =~ m|\.\./|;
+
     return MJB::Backend::Jekyll::MarkdownFile->new(
         root => $self->repo_path,
         path => $self->repo_path . $filename,