mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-10 05:48:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

[1.8.x] Fixed #24625 -- Prevented arbitrary file inclusion in admindocs

Browse source 
Thanks Tim Graham for the review.

Backport of 09595b4fc6 from master
This commit is contained in:
Markus Holtermann 2015-03-31 15:47:06 +02:00
parent 774d09a7dd
commit 3862826fed
5 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
tests/admin_docs/models.py
View file

@ -29,6 +29,12 @@ class Person(models.Model):
Field storing :model:`myapp.Company` where the person works.
(DESCRIPTION)
.. raw:: html
:file: admin_docs/evilfile.txt
.. include:: admin_docs/evilfile.txt
"""
first_name = models.CharField(max_length=200, help_text="The person's first name")
last_name = models.CharField(max_length=200, help_text="The person's last name")