Ticket #4952: 4952.diff

File 4952.diff, 2.6 KB (added by Gary Wilson, 12 years ago)

quick fix

  • django/template/loaders/app_directories.py

    === modified file 'django/template/loaders/app_directories.py'
     
    1 # Wrapper for loading templates from "template" directories in installed app packages.
     1"""
     2Wrapper for loading templates from "template" directories in INSTALLED_APPS
     3packages.
     4"""
     5
     6import os
    27
    38from django.conf import settings
    49from django.core.exceptions import ImproperlyConfigured
    510from django.template import TemplateDoesNotExist
    6 import os
    711
    812# At compile time, cache the directories to search.
    913app_template_dirs = []
     
    2832app_template_dirs = tuple(app_template_dirs)
    2933
    3034def get_template_sources(template_name, template_dirs=None):
     35    is_absolute = os.path.isabs(template_name)
    3136    for template_dir in app_template_dirs:
     37        # When os.path.join encounters a component that is an absolute path,
     38        # all previous components are thrown away.  That is not what we want
     39        # since os.path.join(['/template/dir/', '/etc/passwd'] -> '/etc/passwd'
     40        # So if the template_name given is an absolute path, only return it if
     41        # it is under the template_dir directory.
     42        if is_absolute and not template_name.startswith(template_dir):
     43            continue
    3244        yield os.path.join(template_dir, template_name)
    3345
    3446def load_template_source(template_name, template_dirs=None):
  • django/template/loaders/filesystem.py

    === modified file 'django/template/loaders/filesystem.py'
     
    1 # Wrapper for loading templates from the filesystem.
     1"""
     2Wrapper for loading templates from the filesystem.
     3"""
     4
     5import os
    26
    37from django.conf import settings
    48from django.template import TemplateDoesNotExist
    5 import os
    69
    710def get_template_sources(template_name, template_dirs=None):
    811    if not template_dirs:
    912        template_dirs = settings.TEMPLATE_DIRS
     13    is_absolute = os.path.isabs(template_name)
    1014    for template_dir in template_dirs:
     15        # When os.path.join encounters a component that is an absolute path,
     16        # all previous components are thrown away.  That is not what we want
     17        # since os.path.join(['/template/dir/', '/etc/passwd'] -> '/etc/passwd'
     18        # So if the template_name given is an absolute path, only return it if
     19        # it is under the template_dir directory.
     20        if is_absolute and not template_name.startswith(template_dir):
     21            continue
    1122        yield os.path.join(template_dir, template_name)
    1223
    1324def load_template_source(template_name, template_dirs=None):
Back to Top