RequestContext methods pollute template variables

[KyleMac]

Imagine the following simple view:

def index(request):
    return render_to_response('template.html', {
        'myvar': 'My Variable'
    }, context_instance=RequestContext(request))

And the following simple template:

{{ myvar }} is {% if not new %}not {% endif %}new.

The output will always be:

My Variable is new.

This is because django.template.base.Variable._resolve_lookup is finding the new() method on RequestContext which is then forced to a string resulting in "[{}]".

If you're asking why you want to access a variable that the view never sets then the reason is that this situation can occur when views are including or extending the same template.

[Aymeric Augustin]

I just attached a test case that demonstrates the problem.

[regebro]

One solution

[regebro]

To solve this we have to explicitly disallow attributes on the context. Or at least disallow class attributes.

I attached a patch that does the last option. But I think a design decision is needed here.

[Aymeric Augustin]

Under which circumstances would Django try to access attributes on the context?

[Tim Graham]

Reported again in #20898

[Tim Graham <timograham@…>]

In 71b5617c24bb997db294480f07611233069e3359:

Fixed #17778 -- Prevented class attributes on context from resolving as template variables.

Thanks KyleMac for the report, regebro for the patch, and Aymeric for the test.

[Tim Graham <timograham@…>]

In ccff25b1431bd1bb9d633b1ca1d3aff79acc33d9:

[1.6.x] Fixed #17778 -- Prevented class attributes on context from resolving as template variables.

Thanks KyleMac for the report, regebro for the patch, and Aymeric for the test.

Backport of 71b5617c24 from master.