Ticket #4952: 4952.2.diff

File 4952.2.diff, 2.5 KB (added by Chris Beaven, 12 years ago)

More robust check

  • django/template/loaders/app_directories.py

     
    1 # Wrapper for loading templates from "template" directories in installed app packages.
     1"""
     2Wrapper for loading templates from "template" directories in INSTALLED_APPS
     3packages.
     4"""
    25
     6import os
     7
    38from django.conf import settings
    49from django.core.exceptions import ImproperlyConfigured
    510from django.template import TemplateDoesNotExist
    6 import os
    711
    812# At compile time, cache the directories to search.
    913app_template_dirs = []
     
    2832app_template_dirs = tuple(app_template_dirs)
    2933
    3034def get_template_sources(template_name, template_dirs=None):
    31     for template_dir in app_template_dirs:
    32         yield os.path.join(template_dir, template_name)
     35    if not template_dirs:
     36        template_dirs = app_template_dirs
     37    for template_dir in template_dirs:
     38        full_template_dir = os.path.join(template_dir, template_name)
     39        # Security check to ensure that we are still in the template directory
     40        # after the os.path.join.
     41        if full_template_dir.startswith(template_dir):
     42            yield full_template_dir
    3343
    3444def load_template_source(template_name, template_dirs=None):
    3545    for filepath in get_template_sources(template_name, template_dirs):
  • django/template/loaders/filesystem.py

     
    1 # Wrapper for loading templates from the filesystem.
     1"""
     2Wrapper for loading templates from the filesystem.
     3"""
    24
     5import os
     6
    37from django.conf import settings
    48from django.template import TemplateDoesNotExist
    5 import os
    69
    710def get_template_sources(template_name, template_dirs=None):
    811    if not template_dirs:
    912        template_dirs = settings.TEMPLATE_DIRS
    1013    for template_dir in template_dirs:
    11         yield os.path.join(template_dir, template_name)
     14        full_template_dir = os.path.join(template_dir, template_name)
     15        # Security check to ensure that we are still in the template directory
     16        # after the os.path.join.
     17        if full_template_dir.startswith(template_dir):
     18            yield full_template_dir
    1219
    1320def load_template_source(template_name, template_dirs=None):
    1421    tried = []
Back to Top