Tim Graham 87d2750b39 [1.4.x] Prevented arbitrary file inclusion with {% ssi %} tag and relative paths. ...

Thanks Rainer Koirikivi for the report and draft patch.

This is a security fix; disclosure to follow shortly.

Backport of 7fe5b656c9 from master

2013-09-10 21:05:47 -04:00

..

loaders

Fixed #17303 -- Ensured the list of template loaders is fully loaded before it is cached. Thanks andrey DOT gtx AT gmail DOT com for the report and patch, and Anssi Kääriäinen for the review.

2011-12-30 12:55:08 +00:00

__init__.py

Fixed #12248 -- Refactored django.template to get code out of __init__.py, to help with avoiding circular import dependencies. Thanks to Tom Tobin for the patch.

2010-11-27 05:47:30 +00:00

base.py

Made a tiny performance improvement in the template system's Parser.parse() -- don't look up the global variables TOKEN_TEXT, etc.

2012-01-28 01:50:14 +00:00

context.py

Added support for time zones. Thanks Luke Plant for the review. Fixed #2626.

2011-11-18 13:01:06 +00:00

debug.py

Fixed #17255 -- Removed "as" prefix from new timezone template filter names for the sake of clarity. Cheers to Aymeric Augustin for bearing with me.

2011-11-18 15:00:08 +00:00

defaultfilters.py

Made dictsort and dictsort reversed template filters fail silently

2012-01-15 02:01:21 +00:00

defaulttags.py

[1.4.x] Prevented arbitrary file inclusion with {% ssi %} tag and relative paths.

2013-09-10 21:05:47 -04:00

loader_tags.py

Fixed #17660 -- Standardize extends tag token parsing

2012-02-21 02:59:05 +00:00

loader.py

Fixed #16866 -- Clearer error message if empty list is passed to select_template. Thanks Silver_Ghost for report and patch.

2011-09-21 14:20:18 +00:00

response.py

Fixed #16935 - misleading message if AttributeError escapes during SimpleTemplateResponse.render

2011-09-30 11:46:23 +00:00

smartif.py

Fixed #16225 -- Removed unused imports. Many thanks to Aymeric Augustin for the work on the patch and Alex for reviewing.

2011-07-13 09:35:51 +00:00