Log message for revision 106174: LP #490514: preserve tainting when calling into DTML from ZPT.
Changed: U Zope/trunk/doc/CHANGES.rst U Zope/trunk/src/Products/PageTemplates/ZRPythonExpr.py U Zope/trunk/src/Products/PageTemplates/tests/testZRPythonExpr.py -=- Modified: Zope/trunk/doc/CHANGES.rst =================================================================== --- Zope/trunk/doc/CHANGES.rst 2009-12-02 15:01:12 UTC (rev 106173) +++ Zope/trunk/doc/CHANGES.rst 2009-12-02 15:43:39 UTC (rev 106174) @@ -60,6 +60,8 @@ Bugs Fixed ++++++++++ +- LP #490514: preserve tainting when calling into DTML from ZPT. + - LP #414757: Don't send a request closed event from a cloned request. - LP #418454: FTP server did not work with Python 2.6.X Modified: Zope/trunk/src/Products/PageTemplates/ZRPythonExpr.py =================================================================== --- Zope/trunk/src/Products/PageTemplates/ZRPythonExpr.py 2009-12-02 15:01:12 UTC (rev 106173) +++ Zope/trunk/src/Products/PageTemplates/ZRPythonExpr.py 2009-12-02 15:43:39 UTC (rev 106174) @@ -69,6 +69,8 @@ this = ns.get('context', ns.get('here')) td.this = this request = ns.get('request', {}) + if hasattr(request, 'taintWrapper'): + request = request.taintWrapper() td._push(request) td._push(InstanceDict(td.this, td)) td._push(ns) Modified: Zope/trunk/src/Products/PageTemplates/tests/testZRPythonExpr.py =================================================================== --- Zope/trunk/src/Products/PageTemplates/tests/testZRPythonExpr.py 2009-12-02 15:01:12 UTC (rev 106173) +++ Zope/trunk/src/Products/PageTemplates/tests/testZRPythonExpr.py 2009-12-02 15:43:39 UTC (rev 106174) @@ -39,6 +39,18 @@ result = call_with_ns(_find_request, names) self.assertEqual(result, {}) + + def test_call_with_request_preserves_tainting(self): + from Products.PageTemplates.ZRPythonExpr import call_with_ns + class Request(dict): + def taintWrapper(self): + return {'tainted': 'found'} + context = ['context'] + here = ['here'] + names = {'context' : context, 'here': here, 'request' : Request()} + + found = call_with_ns(lambda td: td['tainted'], names) + self.assertEqual(found, 'found') def test_suite(): return unittest.makeSuite(MiscTests) _______________________________________________ Zope-Checkins maillist - Zope-Checkins@zope.org https://mail.zope.org/mailman/listinfo/zope-checkins