From 98ac69af538f8d93d6f940b382dcce2d5fc6173a Mon Sep 17 00:00:00 2001 From: Aymeric Augustin Date: Thu, 20 Nov 2014 22:18:07 +0100 Subject: [PATCH] Encapsulated ALLOWED_INCLUDE_ROOTS in Engine. --- django/template/defaulttags.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/django/template/defaulttags.py b/django/template/defaulttags.py index 0defc17057..fa1cbfa98e 100644 --- a/django/template/defaulttags.py +++ b/django/template/defaulttags.py @@ -375,9 +375,9 @@ class RegroupNode(Node): return '' -def include_is_allowed(filepath): +def include_is_allowed(filepath, allowed_include_roots): filepath = os.path.abspath(filepath) - for root in settings.ALLOWED_INCLUDE_ROOTS: + for root in allowed_include_roots: if filepath.startswith(root): return True return False @@ -391,7 +391,7 @@ class SsiNode(Node): def render(self, context): filepath = self.filepath.resolve(context) - if not include_is_allowed(filepath): + if not include_is_allowed(filepath, context.engine.allowed_include_roots): if settings.DEBUG: return "[Didn't have permission to include file]" else: