summaryrefslogtreecommitdiff
path: root/django/core
diff options
context:
space:
mode:
authorAdrian Holovaty <adrian@holovaty.com>2007-07-03 16:03:51 +0000
committerAdrian Holovaty <adrian@holovaty.com>2007-07-03 16:03:51 +0000
commit7ed1a919681b5b028c3f6eef1a862ff91b66feb2 (patch)
treeb3388b139116983e5d15591d929b74daefbf6081 /django/core
parent160dac766c2cc5fd9bb71d5e97c5939c31bd7e35 (diff)
newforms-admin: Merged to [5595]
git-svn-id: http://code.djangoproject.com/svn/django/branches/newforms-admin@5596 bcc190cf-cafb-0310-a4f2-bffc1f526a37
Diffstat (limited to 'django/core')
-rw-r--r--django/core/mail.py19
-rw-r--r--django/core/management.py6
2 files changed, 16 insertions, 9 deletions
diff --git a/django/core/mail.py b/django/core/mail.py
index e9d8a150a1..2f252df724 100644
--- a/django/core/mail.py
+++ b/django/core/mail.py
@@ -62,22 +62,23 @@ def make_msgid(idstring=None):
class BadHeaderError(ValueError):
pass
-class SafeHeaderMixin(object):
+class SafeMIMEText(MIMEText):
def __setitem__(self, name, val):
"Forbids multi-line headers, to prevent header injection."
if '\n' in val or '\r' in val:
raise BadHeaderError, "Header values can't contain newlines (got %r for header %r)" % (val, name)
if name == "Subject":
val = Header(val, settings.DEFAULT_CHARSET)
- # Note: using super() here is safe; any __setitem__ overrides must use
- # the same argument signature.
- super(SafeHeaderMixin, self).__setitem__(name, val)
+ MIMEText.__setitem__(self, name, val)
-class SafeMIMEText(MIMEText, SafeHeaderMixin):
- pass
-
-class SafeMIMEMultipart(MIMEMultipart, SafeHeaderMixin):
- pass
+class SafeMIMEMultipart(MIMEMultipart):
+ def __setitem__(self, name, val):
+ "Forbids multi-line headers, to prevent header injection."
+ if '\n' in val or '\r' in val:
+ raise BadHeaderError, "Header values can't contain newlines (got %r for header %r)" % (val, name)
+ if name == "Subject":
+ val = Header(val, settings.DEFAULT_CHARSET)
+ MIMEMultipart.__setitem__(self, name, val)
class SMTPConnection(object):
"""
diff --git a/django/core/management.py b/django/core/management.py
index 1c049a790b..c6107e90e3 100644
--- a/django/core/management.py
+++ b/django/core/management.py
@@ -832,9 +832,15 @@ def startproject(project_name, directory):
sys.stderr.write(style.ERROR("Error: '%r' conflicts with the name of an existing Python module and cannot be used as a project name. Please try another name.\n" % project_name))
sys.exit(1)
_start_helper('project', project_name, directory)
+
# Create a random SECRET_KEY hash, and put it in the main settings.
main_settings_file = os.path.join(directory, project_name, 'settings.py')
settings_contents = open(main_settings_file, 'r').read()
+
+ # If settings.py was copied from a read-only source, make it writeable.
+ if not os.access(main_settings_file, os.W_OK):
+ os.chmod(main_settings_file, 0600)
+
fp = open(main_settings_file, 'w')
secret_key = ''.join([choice('abcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*(-_=+)') for i in range(50)])
settings_contents = re.sub(r"(?<=SECRET_KEY = ')'", secret_key + "'", settings_contents)