mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-19 02:01:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

[1.8.x] Fixed #24625 -- Prevented arbitrary file inclusion in admindocs

Browse source 
Thanks Tim Graham for the review.

Backport of 09595b4fc6 from master
This commit is contained in:
Markus Holtermann 2015-03-31 15:47:06 +02:00
parent 774d09a7dd
commit 3862826fed
5 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
django/contrib/admindocs/utils.py
View file

@ -67,7 +67,9 @@ def parse_rst(text, default_reference_context, thing_being_parsed=None):
'doctitle_xform': True,
'inital_header_level': 3,
"default_reference_context": default_reference_context,
"link_base": reverse('django-admindocs-docroot').rstrip('/')
"link_base": reverse('django-admindocs-docroot').rstrip('/'),
'raw_enabled': False,
'file_insertion_enabled': False,
}
if thing_being_parsed:
thing_being_parsed = force_bytes("<%s>" % thing_being_parsed)