Ticket #914: admin_modify-mr.py.patch

admin_modify.py

@@ -18 +18 @@
     return '_'.join([s.lower() for s in word_re.findall(name)[:-1]])
 
 def include_admin_script(script_path):
-    return '<script type="text/javascript" src="%s%s"></script>' % (settings.ADMIN_MEDIA_PREFIX, script_path)
+    url_pattern = (r'''(?x)((http|https|ftp)://(\w+[:.]?){2,}(/?|[^ \n\r"']+[\w/!?.=#])(?=[\s\.,>)"'\]]))''')
+    if re.match(url_pattern, script_path) or script_path[0] == '/':
+        return '<script type="text/javascript" src="%s"></script>' % (script_path)
+    else:
+        return '<script type="text/javascript" src="%s%s"></script>' % (settings.ADMIN_MEDIA_PREFIX, script_path)
 include_admin_script = register.simple_tag(include_admin_script)
 
 def submit_row(context):