mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 06:06:09 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #24625 -- Prevented arbitrary file inclusion in admindocs

Browse Source 
Thanks Tim Graham for the review.
This commit is contained in:
Markus Holtermann
2015-03-31 15:47:06 +02:00
parent 4e7ed8d0d3
commit 09595b4fc6
5 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
tests/admin_docs/models.py
View File

@@ -29,6 +29,12 @@ class Person(models.Model):
Field storing :model:`myapp.Company` where the person works.
(DESCRIPTION)
.. raw:: html
:file: admin_docs/evilfile.txt
.. include:: admin_docs/evilfile.txt
"""
first_name = models.CharField(max_length=200, help_text="The person's first name")
last_name = models.CharField(max_length=200, help_text="The person's last name")