Sanitize login return url and theme path

Author: rxtur

BlogEngine/BlogEngine.Core/BlogSettings.cs

@@ -420,27 +420,27 @@ public string Theme
                     var request = context.Request;
                     if (request.QueryString["theme"] != null)
                     {
-                        return request.QueryString["theme"];
+                        return request.QueryString["theme"].SanitizePath();
                     }
 
                     var cookie = request.Cookies[this.ThemeCookieName];
                     if (cookie != null)
                     {
-                        return cookie.Value;
+                        return cookie.Value.SanitizePath();
                     }
 
                     if (Utils.ShouldForceMainTheme(request))
                     {
-                        return this.configuredTheme;
+                        return this.configuredTheme.SanitizePath();
                     }
                 }
 
-                return this.configuredTheme;
+                return this.configuredTheme.SanitizePath();
             }
 
             set
             {
-                this.configuredTheme = String.IsNullOrEmpty(value) ? String.Empty : value;
+                this.configuredTheme = String.IsNullOrEmpty(value) ? String.Empty : value.SanitizePath();
             }
         }
 

BlogEngine/BlogEngine.NET/Custom/Controls/PostList.ascx.cs

@@ -123,7 +123,7 @@ private void BindPosts()
 
             var theme = Request.QueryString["theme"];
             if(!string.IsNullOrEmpty(theme))
-                theme = theme.Replace(".", "").Replace("/", "").Replace("\\", "");
+                theme = theme.SanitizePath();
 
             var path = string.Format("{0}Custom/Themes/{1}/PostView.ascx", Utils.ApplicationRelativeWebRoot, BlogSettings.Instance.GetThemeWithAdjustments(theme));
             var counter = 0;