#11234: BlockNode unsafely manages context
-----------------------------+----------------------------------------------
Reporter: brutimus | Owner: brutimus
Status: new | Milestone:
Component: Template system | Version: SVN
Keywords: | Stage: Unreviewed
Has_patch: 1 |
-----------------------------+----------------------------------------------
To allow the use of {{ block.super }}, the BlockNode uses context.push()
to add itself to the context at position zero. After the scope of the
context has been rendered, the BlockNode then assumes it is still position
zero and removes itself with context.pop().
{{{
#!python
def render(self, context):
context.push()
# Save context in case of block.super().
self.context = context
context['block'] = self
result = self.nodelist.render(context)
context.pop()
return result
}}}
The problem with this arises when any template tag call inside a {% block
... %} tag modifies the context. Anything added to the context assumes
position zero, thus when the BlockNode attempts to clean up with
context.pop(), it will remove whatever was last added to the context and
possibly leave the block object behind.
To resolve this issue, instead of using the offending context.pop(), I
propose storing a reference to the object the BlockNode adds to the
context, then removing that object from the context by reference with
context.dicts.remove(reference). This method ensures the block object is
removed from the context and that all other context objects will be
available in the next {% block ... %} occurrence.
Patch attached.
--
Ticket URL: <http://code.djangoproject.com/ticket/11234>
Django <http://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/django-updates?hl=en
-~----------~----~----~----~------~----~------~--~---
