Tres Seaver wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Jim Fulton wrote:
Zope 3, as releases is not affected by the security hole that
has plagued Zope 2, however, Michael Haubenwallner has pointed
out that some add-on-products, such as zwiki and bugtracker, may
provide TTW reST.
They appear to be "safe" for the moment, but not because they
intentionally disable file inclusion: rather, they have a bug (they set
the 'encoding' to 'unicode', which then causes an exception).
Both restructuredText directives 'include' and 'raw' have an 'encoding'
option to set the name of text encoding of the external data file/raw
data (file or URL), it defaults to the document's encoding (if specified).
.. include:: filename.ext
.. raw:: html
should work as expected
Zope3-dev mailing list