Opened 4 years ago

Closed 4 years ago

Last modified 4 years ago

#14653 closed (fixed)

GeoDjango utils shouldn't include a Popen shortcut

Reported by: PaulM Owned by: nobody
Component: GIS Version: 1.2
Severity: Keywords:
Cc: Triage Stage: Accepted
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: UI/UX:

Description

contrib.gis.db.backends.util includes getstatusoutput(cmd), which executes a command using Popen and returns the result.

This function doesn't seem to be in use anywhere within the GIS code. Including shortcuts like this without good reason encourages dangerous behavior. I propose that we remove this now, or mark it with a DeprecationWarning and remove it in 1.4. It is undocumented, and presents a potential security hole for unwary users.

Change History (4)

comment:1 Changed 4 years ago by lukeplant

  • Needs documentation unset
  • Needs tests unset
  • Patch needs improvement unset
  • Triage Stage changed from Unreviewed to Accepted

Since it is not documented, we should just remove it.

comment:2 Changed 4 years ago by jbronn

  • Resolution set to fixed
  • Status changed from new to closed

(In [14508]) Fixed #14653 -- Removed vestigal getstatusoutput from GeoDjango utils.

comment:3 Changed 4 years ago by jbronn

(In [14509]) [1.2.X] Fixed #14653 -- Removed vestigal getstatusoutput from GeoDjango utils.

Backport of r14508 from trunk.

comment:4 Changed 4 years ago by jacob

  • milestone 1.3 deleted

Milestone 1.3 deleted

Note: See TracTickets for help on using tickets.
Back to Top