mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 22:26:08 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #24625 -- Prevented arbitrary file inclusion in admindocs

Browse Source 
Thanks Tim Graham for the review.
This commit is contained in:
Markus Holtermann
2015-03-31 15:47:06 +02:00
parent 4e7ed8d0d3
commit 09595b4fc6
5 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
django/contrib/admindocs/utils.py
View File

@@ -67,7 +67,9 @@ def parse_rst(text, default_reference_context, thing_being_parsed=None):
'doctitle_xform': True,
'inital_header_level': 3,
"default_reference_context": default_reference_context,
"link_base": reverse('django-admindocs-docroot').rstrip('/')
"link_base": reverse('django-admindocs-docroot').rstrip('/'),
'raw_enabled': False,
'file_insertion_enabled': False,
}
if thing_being_parsed:
thing_being_parsed = force_bytes("<%s>" % thing_being_parsed)