From 66c0f632c360cc72db5f0478c64a12a3ef372a5e Mon Sep 17 00:00:00 2001
From: "Gerasimos (Makis) Maropoulos" <kataras2006@hotmail.com>
Date: Sat, 15 Feb 2020 21:16:21 +0200
Subject: [PATCH] fix of
 https://github.com/kataras/iris/issues/1450#issuecomment-586581677

Former-commit-id: 2b8dfec7d43298bc9ace94595359867180634f04
---
 go.mod      |  2 +-
 view/pug.go | 23 +++++++++++++++--------
 2 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/go.mod b/go.mod
index 1021a91a9..1ec3030c8 100644
--- a/go.mod
+++ b/go.mod
@@ -18,7 +18,7 @@ require (
 	github.com/iris-contrib/go.uuid v2.0.0+incompatible
 	github.com/iris-contrib/pongo2 v0.0.1
 	github.com/iris-contrib/schema v0.0.1
-	github.com/iris-contrib/jade v1.1.1
+	github.com/iris-contrib/jade v1.1.2
 	github.com/json-iterator/go v1.1.9
 	github.com/kataras/golog v0.0.10
 	github.com/kataras/neffos v0.0.14
diff --git a/view/pug.go b/view/pug.go
index 9c312d297..0a20aec2d 100644
--- a/view/pug.go
+++ b/view/pug.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"io/ioutil"
 	"path"
+	"strings"
 
 	"github.com/iris-contrib/jade"
 )
@@ -22,28 +23,34 @@ import (
 // https://github.com/kataras/iris/tree/master/_examples/view/template_pug_3
 func Pug(directory, extension string) *HTMLEngine {
 	s := HTML(directory, extension)
+
 	s.middleware = func(name string, text []byte) (contents string, err error) {
+		name = path.Join(path.Clean(directory), name)
 		tmpl := jade.New(name)
-		// Fixes: https://github.com/kataras/iris/issues/1450
-		// by adding a custom ReadFunc inside the jade parser.
-		// And Also able to use relative paths on "extends" and "include" directives:
-		// e.g. instead of extends "templates/layout.pug" we use "layout.pug"
-		// so contents of templates are independent of their root location.
 		tmpl.ReadFunc = func(name string) ([]byte, error) {
-			name = path.Join(directory, name)
+			if !strings.HasPrefix(path.Clean(name), path.Clean(directory)) {
+				name = path.Join(directory, name)
+			}
+
 			if s.assetFn != nil {
 				return s.assetFn(name)
 			}
 			return ioutil.ReadFile(name)
 		}
 
-		tmpl, err = tmpl.Parse(text)
+		// Fixes: https://github.com/kataras/iris/issues/1450
+		// by adding a custom ReadFunc inside the jade parser.
+		// And Also able to use relative paths on "extends" and "include" directives:
+		// e.g. instead of extends "templates/layout.pug" we use "layout.pug"
+		// so contents of templates are independent of their root location.
+
+		exec, err := tmpl.Parse(text)
 		if err != nil {
 			return
 		}
 
 		b := new(bytes.Buffer)
-		tmpl.WriteIn(b)
+		exec.WriteIn(b)
 		return b.String(), nil
 	}
 	return s