Encapsulated ALLOWED_INCLUDE_ROOTS in Engine.

1 files changed, 3 insertions, 3 deletions

diff --git a/django/template/defaulttags.py b/django/template/defaulttags.py
index 0defc17057..fa1cbfa98e 100644
--- a/django/template/defaulttags.py
+++ b/django/template/defaulttags.py
@@ -375,9 +375,9 @@ class RegroupNode(Node):
         return ''
 
 
-def include_is_allowed(filepath):
+def include_is_allowed(filepath, allowed_include_roots):
     filepath = os.path.abspath(filepath)
-    for root in settings.ALLOWED_INCLUDE_ROOTS:
+    for root in allowed_include_roots:
         if filepath.startswith(root):
             return True
     return False
@@ -391,7 +391,7 @@ class SsiNode(Node):
     def render(self, context):
         filepath = self.filepath.resolve(context)
 
-        if not include_is_allowed(filepath):
+        if not include_is_allowed(filepath, context.engine.allowed_include_roots):
             if settings.DEBUG:
                 return "[Didn't have permission to include file]"
             else: