Opened 6 years ago

Closed 6 years ago

Last modified 5 years ago

#14653 closed (fixed)

GeoDjango utils shouldn't include a Popen shortcut

Reported by: Paul McMillan Owned by: nobody
Component: GIS Version: 1.2
Severity: Keywords:
Cc: Triage Stage: Accepted
Has patch: no Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: UI/UX:

Description

contrib.gis.db.backends.util includes getstatusoutput(cmd), which executes a command using Popen and returns the result.

This function doesn't seem to be in use anywhere within the GIS code. Including shortcuts like this without good reason encourages dangerous behavior. I propose that we remove this now, or mark it with a DeprecationWarning and remove it in 1.4. It is undocumented, and presents a potential security hole for unwary users.

Change History (4)

comment:1 Changed 6 years ago by Luke Plant

Triage Stage: UnreviewedAccepted

Since it is not documented, we should just remove it.

comment:2 Changed 6 years ago by jbronn

Resolution: fixed
Status: newclosed

(In [14508]) Fixed #14653 -- Removed vestigal getstatusoutput from GeoDjango utils.

comment:3 Changed 6 years ago by jbronn

(In [14509]) [1.2.X] Fixed #14653 -- Removed vestigal getstatusoutput from GeoDjango utils.

Backport of r14508 from trunk.

comment:4 Changed 5 years ago by Jacob

milestone: 1.3

Milestone 1.3 deleted

Note: See TracTickets for help on using tickets.
Back to Top