1.1 --- a/framework/env/request/default_router.lua	Sun Mar 01 21:20:29 2015 +0100
     1.2 +++ b/framework/env/request/default_router.lua	Sun Mar 01 21:38:07 2015 +0100
     1.3 @@ -12,10 +12,26 @@
     1.4    if not path then
     1.5      return nil
     1.6    end
     1.7 -  local module, action, view, id, suffix
     1.8    if path == "" then
     1.9      return {module = "index", view = "index"}
    1.10    end
    1.11 +  local static = string.match(path, "^static/([-./0-9A-Z_a-z]+)$")
    1.12 +  if static then
    1.13 +    if
    1.14 +      string.match(static, "^/") or
    1.15 +      string.match(static, "//") or
    1.16 +      string.match(static, "/$") or
    1.17 +      string.match(static, "^%.%.?$") or
    1.18 +      string.match(static, "/%.%.?$") or
    1.19 +      string.match(static, "^%.%.?/") or
    1.20 +      string.match(static, "/%.%.?/")  -- TODO: improve
    1.21 +    then
    1.22 +      return nil
    1.23 +    else
    1.24 +      return {static = static}
    1.25 +    end
    1.26 +  end
    1.27 +  local module, action, view, id, suffix
    1.28    module = string.match(path, "^([^/]+)/$")
    1.29    if module then
    1.30      return {module = module, view = "index"}

     2.1 --- a/framework/env/request/process.lua	Sun Mar 01 21:20:29 2015 +0100
     2.2 +++ b/framework/env/request/process.lua	Sun Mar 01 21:38:07 2015 +0100
     2.3 @@ -15,6 +15,14 @@
     2.4    local success, error_info = xpcall(
     2.5      function()
     2.6  
     2.7 +      if request._route.static then
     2.8 +        local f = assert(file.open(request._route.static, "r"))
     2.9 +        local d = f:read("*a")
    2.10 +        f:close()
    2.11 +        slot.put_into("data", d)
    2.12 +        slot.set_layout(nil, "application/octet-stream")  -- TODO
    2.13 +      end
    2.14 +
    2.15        -- restore slots if coming from http redirect
    2.16        local tempstore_value = request._http_request.get_params["_tempstore"]
    2.17        if tempstore_value then