Add dirname check
diff --git a/www/secretary/workbench/views/actions/ccla.json.rb b/www/secretary/workbench/views/actions/ccla.json.rb
index 952fcf0..92e6b51 100644
--- a/www/secretary/workbench/views/actions/ccla.json.rb
+++ b/www/secretary/workbench/views/actions/ccla.json.rb
@@ -69,6 +69,9 @@
dest = message.write_att(@selected, @signature)
if dest.size > 1 # write to a container directory
+ unless @filename =~ /\A[a-zA-Z][-.\w]+\z/ # previously done by write_svn
+ raise IOError.new("invalid filename: #{@filename}")
+ end
container = ASF::SVN.svnpath!('cclas', @filename)
extras << ['mkdir', container]
dest.each do |name, path|
