diff options
| author | Aymeric Augustin <aymeric.augustin@m4x.org> | 2014-11-11 18:59:49 +0100 |
|---|---|---|
| committer | Aymeric Augustin <aymeric.augustin@m4x.org> | 2014-11-11 19:05:14 +0100 |
| commit | b8ba73cd0cb6a3dbdaeb3df65936970956829de3 (patch) | |
| tree | 6a21c861d3461a6af30358c7b0437c662c33cc5c /django/core | |
| parent | 40ba6f21bb5a728987da9a7055c74fa3c65da4db (diff) | |
Raised SuspiciousFileOperation in safe_join.
Added a test for the condition safe_join is designed to prevent.
Previously, a generic ValueError was raised. It was impossible to tell
an intentional exception raised to implement safe_join's contract from
an unintentional exception caused by incorrect inputs or unexpected
conditions. That resulted in bizarre exception catching patterns, which
this patch removes.
Since safe_join is a private API and since the change is unlikely to
create security issues for users who use it anyway -- at worst, an
uncaught SuspiciousFileOperation exception will bubble up -- it isn't
documented.
Diffstat (limited to 'django/core')
| -rw-r--r-- | django/core/files/storage.py | 6 |
1 files changed, 1 insertions, 5 deletions
diff --git a/django/core/files/storage.py b/django/core/files/storage.py index cff2d06f1a..7a9bc06665 100644 --- a/django/core/files/storage.py +++ b/django/core/files/storage.py @@ -277,11 +277,7 @@ class FileSystemStorage(Storage): return directories, files def path(self, name): - try: - path = safe_join(self.location, name) - except ValueError: - raise SuspiciousFileOperation("Attempted access to '%s' denied." % name) - return os.path.normpath(path) + return safe_join(self.location, name) def size(self, name): return os.path.getsize(self.path(name)) |