Ticket #4952: 4952.2.diff

django/template/loaders/app_directories.py

@@ -1 @@
-# Wrapper for loading templates from "template" directories in installed app packages.
+"""
+Wrapper for loading templates from "template" directories in INSTALLED_APPS
+packages.
+"""
 
+import os
+
 from django.conf import settings
 from django.core.exceptions import ImproperlyConfigured
 from django.template import TemplateDoesNotExist
-import os
 
 # At compile time, cache the directories to search.
 app_template_dirs = []
@@ -28 +32 @@
 app_template_dirs = tuple(app_template_dirs)
 
 def get_template_sources(template_name, template_dirs=None):
-    for template_dir in app_template_dirs:
-        yield os.path.join(template_dir, template_name)
+    if not template_dirs:
+        template_dirs = app_template_dirs
+    for template_dir in template_dirs:
+        full_template_dir = os.path.join(template_dir, template_name)
+        # Security check to ensure that we are still in the template directory
+        # after the os.path.join.
+        if full_template_dir.startswith(template_dir):
+            yield full_template_dir
 
 def load_template_source(template_name, template_dirs=None):
     for filepath in get_template_sources(template_name, template_dirs):

django/template/loaders/filesystem.py

@@ -1 @@
-# Wrapper for loading templates from the filesystem.
+"""
+Wrapper for loading templates from the filesystem.
+"""
 
+import os
+
 from django.conf import settings
 from django.template import TemplateDoesNotExist
-import os
 
 def get_template_sources(template_name, template_dirs=None):
     if not template_dirs:
         template_dirs = settings.TEMPLATE_DIRS
     for template_dir in template_dirs:
-        yield os.path.join(template_dir, template_name)
+        full_template_dir = os.path.join(template_dir, template_name)
+        # Security check to ensure that we are still in the template directory
+        # after the os.path.join.
+        if full_template_dir.startswith(template_dir):
+            yield full_template_dir
 
 def load_template_source(template_name, template_dirs=None):
     tried = []