From cfeb125624797bcdf02e9f7582aab73e9e5d2cff Mon Sep 17 00:00:00 2001
From: Cynthia Lin <cynthialin1004@gmail.com>
Date: Mon, 2 Oct 2017 10:51:17 -0700
Subject: [PATCH] zerver: Block access to subdirectories when visiting user
 docs articles.

Fixes #6770
---
 zerver/tests/test_urls.py    | 2 +-
 zerver/views/integrations.py | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/zerver/tests/test_urls.py b/zerver/tests/test_urls.py
index d2c04e3ca6..37e486859b 100644
--- a/zerver/tests/test_urls.py
+++ b/zerver/tests/test_urls.py
@@ -47,7 +47,7 @@ class PublicURLTest(ZulipTestCase):
                           "/json/messages",
                           "/api/v1/streams",
                           ],
-                    404: ["/help/nonexistent"],
+                    404: ["/help/nonexistent", "/help/include/admin"],
                     }
 
         # Add all files in 'templates/zerver/help' directory (except for 'main.html' and
diff --git a/zerver/views/integrations.py b/zerver/views/integrations.py
index 4223038cfa..10bd9acaf4 100644
--- a/zerver/views/integrations.py
+++ b/zerver/views/integrations.py
@@ -56,6 +56,8 @@ class HelpView(ApiURLView):
         # type: (str) -> str
         if article == "":
             article = "index"
+        elif "/" in article:
+            article = "missing"
         return self.path_template % (article,)
 
     def get_context_data(self, **kwargs):
@@ -83,6 +85,8 @@ class HelpView(ApiURLView):
         except loader.TemplateDoesNotExist:
             # Ensure a 404 response code if no such document
             result.status_code = 404
+        if "/" in article:
+            result.status_code = 404
         return result