relative path fix

src/routes/plugins.js

@@ -1,41 +1,31 @@
 "use strict";
 
-var	_ = require('underscore'),
+var	_ = require('underscore');
-	nconf = require('nconf'),
+var path = require('path');
-	path = require('path'),
-	fs = require('fs'),
-	validator = require('validator'),
-	async = require('async'),
-	winston = require('winston'),
-
-	plugins = require('../plugins'),
-	helpers = require('../controllers/helpers');
 
+var plugins = require('../plugins');
 
 module.exports = function(app, middleware, controllers) {
 	// Static Assets
 	app.get('/plugins/:id/*', middleware.addExpiresHeaders, function(req, res, next) {
-		var	relPath = req._parsedUrl.pathname.replace('/plugins/', ''),
+
-			matches = _.map(plugins.staticDirs, function(realPath, mappedPath) {
+		var	relPath = req._parsedUrl.pathname.replace('/plugins/', '');
-				if (relPath.match(mappedPath)) {
+
-					return mappedPath;
+		var matches = _.map(plugins.staticDirs, function(realPath, mappedPath) {
-				} else {
+			if (relPath.match(mappedPath)) {
-					return null;
+				var pathToFile = path.join(plugins.staticDirs[mappedPath], decodeURIComponent(relPath.slice(mappedPath.length)));
+				if (pathToFile.startsWith(plugins.staticDirs[mappedPath])) {
+					return pathToFile;
 				}
-			}).filter(Boolean);
+			}
 
-		if (!matches) {
+			return null;
+		}).filter(Boolean);
+
+		if (!matches || !matches.length) {
 			return next();
 		}
 
-		matches = matches.map(function(mappedPath) {
+		res.sendFile(matches[0]);
-			return path.join(plugins.staticDirs[mappedPath], decodeURIComponent(relPath.slice(mappedPath.length)));
-		});
-
-		if (matches.length) {
-			res.sendFile(matches[0]);
-		} else {
-			next();
-		}
 	});
-};
+};