Fixed static middleware

Signed-off-by: Vishal Rana <vr@labstack.com>

echo.go

@@ -399,6 +399,9 @@ func (e *Echo) Match(methods []string, path string, handler HandlerFunc, middlew
 // Static registers a new route with path prefix to serve static files from the
 // provided root directory.
 func (e *Echo) Static(prefix, root string) {
+	if root == "" {
+		root = "." // For security we want to restrict to CWD.
+	}
 	static(e, prefix, root)
 }
 

middleware/static.go

@@ -88,8 +88,17 @@ func StaticWithConfig(config StaticConfig) echo.MiddlewareFunc {
 				if config.Browse {
 					return listDir(name, c.Response())
 				}
-				return c.File(filepath.Join(name, config.Index))
+				name = filepath.Join(name, config.Index)
+				fi, err = os.Stat(name)
+				if err != nil {
+					if os.IsNotExist(err) {
+						return next(c)
+					}
+					return err
+				}
+				return c.File(name)
 			}
+
 			return c.File(name)
 		}
 	}