Ticket #4952: 4952.diff

django/template/loaders/app_directories.py

@@ -1 @@
-# Wrapper for loading templates from "template" directories in installed app packages.
+"""
+Wrapper for loading templates from "template" directories in INSTALLED_APPS
+packages.
+"""
+
+import os
 
 from django.conf import settings
 from django.core.exceptions import ImproperlyConfigured
 from django.template import TemplateDoesNotExist
-import os
 
 # At compile time, cache the directories to search.
 app_template_dirs = []
@@ -28 +32 @@
 app_template_dirs = tuple(app_template_dirs)
 
 def get_template_sources(template_name, template_dirs=None):
+    is_absolute = os.path.isabs(template_name)
     for template_dir in app_template_dirs:
+        # When os.path.join encounters a component that is an absolute path,
+        # all previous components are thrown away.  That is not what we want
+        # since os.path.join(['/template/dir/', '/etc/passwd'] -> '/etc/passwd'
+        # So if the template_name given is an absolute path, only return it if
+        # it is under the template_dir directory.
+        if is_absolute and not template_name.startswith(template_dir):
+            continue
         yield os.path.join(template_dir, template_name)
 
 def load_template_source(template_name, template_dirs=None):

django/template/loaders/filesystem.py

@@ -1 @@
-# Wrapper for loading templates from the filesystem.
+"""
+Wrapper for loading templates from the filesystem.
+"""
+
+import os
 
 from django.conf import settings
 from django.template import TemplateDoesNotExist
-import os
 
 def get_template_sources(template_name, template_dirs=None):
     if not template_dirs:
         template_dirs = settings.TEMPLATE_DIRS
+    is_absolute = os.path.isabs(template_name)
     for template_dir in template_dirs:
+        # When os.path.join encounters a component that is an absolute path,
+        # all previous components are thrown away.  That is not what we want
+        # since os.path.join(['/template/dir/', '/etc/passwd'] -> '/etc/passwd'
+        # So if the template_name given is an absolute path, only return it if
+        # it is under the template_dir directory.
+        if is_absolute and not template_name.startswith(template_dir):
+            continue
         yield os.path.join(template_dir, template_name)
 
 def load_template_source(template_name, template_dirs=None):