Log message for revision 106133: LP #490514: preserve tainting when calling into DTML from ZPT.
Changed: U Zope/branches/2.11/doc/CHANGES.txt U Zope/branches/2.11/lib/python/Products/PageTemplates/ZRPythonExpr.py U Zope/branches/2.11/lib/python/Products/PageTemplates/tests/testZRPythonExpr.py -=- Modified: Zope/branches/2.11/doc/CHANGES.txt =================================================================== --- Zope/branches/2.11/doc/CHANGES.txt 2009-11-30 23:18:24 UTC (rev 106132) +++ Zope/branches/2.11/doc/CHANGES.txt 2009-11-30 23:19:20 UTC (rev 106133) @@ -8,6 +8,8 @@ Bugs Fixed + - LP #490514: preserve tainting when calling into DTML from ZPT. + - LP #360761 (backported from Acquisition trunk): fix iteration proxy to pass `self` acquisition-wrapped into `__iter__` and `__getitem__`. Modified: Zope/branches/2.11/lib/python/Products/PageTemplates/ZRPythonExpr.py =================================================================== --- Zope/branches/2.11/lib/python/Products/PageTemplates/ZRPythonExpr.py 2009-11-30 23:18:24 UTC (rev 106132) +++ Zope/branches/2.11/lib/python/Products/PageTemplates/ZRPythonExpr.py 2009-11-30 23:19:20 UTC (rev 106133) @@ -69,6 +69,8 @@ this = ns.get('context', ns.get('here')) td.this = this request = ns.get('request', {}) + if hasattr(request, 'taintWrapper'): + request = request.taintWrapper() td._push(request) td._push(InstanceDict(td.this, td)) td._push(ns) Modified: Zope/branches/2.11/lib/python/Products/PageTemplates/tests/testZRPythonExpr.py =================================================================== --- Zope/branches/2.11/lib/python/Products/PageTemplates/tests/testZRPythonExpr.py 2009-11-30 23:18:24 UTC (rev 106132) +++ Zope/branches/2.11/lib/python/Products/PageTemplates/tests/testZRPythonExpr.py 2009-11-30 23:19:20 UTC (rev 106133) @@ -39,6 +39,18 @@ result = call_with_ns(_find_request, names) self.assertEqual(result, {}) + + def test_call_with_request_preserves_tainting(self): + from Products.PageTemplates.ZRPythonExpr import call_with_ns + class Request(dict): + def taintWrapper(self): + return {'tainted': 'found'} + context = ['context'] + here = ['here'] + names = {'context' : context, 'here': here, 'request' : Request()} + + found = call_with_ns(lambda td: td['tainted'], names) + self.assertEqual(found, 'found') def test_suite(): return unittest.makeSuite(MiscTests) _______________________________________________ Zope-Checkins maillist - Zope-Checkins@zope.org https://mail.zope.org/mailman/listinfo/zope-checkins