id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
11234	BlockNode unsafely manages context	Sean Stoops	Sean Stoops	"To allow the use of {{ block.super }}, the BlockNode uses context.push() to add itself to the context at position zero.  After the scope of the context has been rendered, the BlockNode then assumes it is still position zero and removes itself with context.pop().

{{{
#!python
    def render(self, context):
        context.push()
        # Save context in case of block.super().
        self.context = context
        context['block'] = self
        result = self.nodelist.render(context)
        context.pop()
        return result
}}}

The problem with this arises when any template tag call inside a {% block ... %} tag modifies the context.  Anything added to the context assumes position zero, thus when the BlockNode attempts to clean up with context.pop(), it will remove whatever was last added to the context and possibly leave the block object behind.

To resolve this issue, instead of using the offending context.pop(), I propose storing a reference to the object the BlockNode adds to the context, then removing that object from the context by reference with context.dicts.remove(reference).  This method ensures the block object is removed from the context and that all other context objects will be available in the next {% block ... %} occurrence.

Patch attached."	Cleanup/optimization	closed	Documentation	dev	Normal	wontfix			Accepted	0	0	0	0	0	0