Prevented flatpage view from directly accessing settings.SITE_ID

Refs #15089
This commit is contained in:
Claude Paroz 2012-10-01 14:17:55 +02:00
parent e7723683dc
commit 1ce4aedcef
1 changed files with 8 additions and 6 deletions

View File

@ -1,9 +1,10 @@
from django.contrib.flatpages.models import FlatPage
from django.template import loader, RequestContext
from django.shortcuts import get_object_or_404
from django.http import Http404, HttpResponse, HttpResponsePermanentRedirect
from django.conf import settings from django.conf import settings
from django.contrib.flatpages.models import FlatPage
from django.contrib.sites.models import get_current_site
from django.core.xheaders import populate_xheaders from django.core.xheaders import populate_xheaders
from django.http import Http404, HttpResponse, HttpResponsePermanentRedirect
from django.shortcuts import get_object_or_404
from django.template import loader, RequestContext
from django.utils.safestring import mark_safe from django.utils.safestring import mark_safe
from django.views.decorators.csrf import csrf_protect from django.views.decorators.csrf import csrf_protect
@ -30,14 +31,15 @@ def flatpage(request, url):
""" """
if not url.startswith('/'): if not url.startswith('/'):
url = '/' + url url = '/' + url
site_id = get_current_site(request).id
try: try:
f = get_object_or_404(FlatPage, f = get_object_or_404(FlatPage,
url__exact=url, sites__id__exact=settings.SITE_ID) url__exact=url, sites__id__exact=site_id)
except Http404: except Http404:
if not url.endswith('/') and settings.APPEND_SLASH: if not url.endswith('/') and settings.APPEND_SLASH:
url += '/' url += '/'
f = get_object_or_404(FlatPage, f = get_object_or_404(FlatPage,
url__exact=url, sites__id__exact=settings.SITE_ID) url__exact=url, sites__id__exact=site_id)
return HttpResponsePermanentRedirect('%s/' % request.path) return HttpResponsePermanentRedirect('%s/' % request.path)
else: else:
raise raise