Code

Opened 3 years ago

Closed 3 years ago

Last modified 3 years ago

#14653 closed (fixed)

GeoDjango utils shouldn't include a Popen shortcut

Reported by: PaulM Owned by: nobody
Component: GIS Version: 1.2
Severity: Keywords:
Cc: Triage Stage: Accepted
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: UI/UX:

Description

contrib.gis.db.backends.util includes getstatusoutput(cmd), which executes a command using Popen and returns the result.

This function doesn't seem to be in use anywhere within the GIS code. Including shortcuts like this without good reason encourages dangerous behavior. I propose that we remove this now, or mark it with a DeprecationWarning and remove it in 1.4. It is undocumented, and presents a potential security hole for unwary users.

Attachments (0)

Change History (4)

comment:1 Changed 3 years ago by lukeplant

  • Needs documentation unset
  • Needs tests unset
  • Patch needs improvement unset
  • Triage Stage changed from Unreviewed to Accepted

Since it is not documented, we should just remove it.

comment:2 Changed 3 years ago by jbronn

  • Resolution set to fixed
  • Status changed from new to closed

(In [14508]) Fixed #14653 -- Removed vestigal getstatusoutput from GeoDjango utils.

comment:3 Changed 3 years ago by jbronn

(In [14509]) [1.2.X] Fixed #14653 -- Removed vestigal getstatusoutput from GeoDjango utils.

Backport of r14508 from trunk.

comment:4 Changed 3 years ago by jacob

  • milestone 1.3 deleted

Milestone 1.3 deleted

Add Comment

Modify Ticket

Change Properties
<Author field>
Action
as closed
as The resolution will be set. Next status will be 'closed'
The resolution will be deleted. Next status will be 'new'
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.