Fixes #8593 -- better handling of safe_join case sensitivity on windows. Thanks for the initial patch, ramiro.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@16267 bcc190cf-cafb-0310-a4f2-bffc1f526a37

1 files changed, 7 insertions, 8 deletions

diff --git a/django/utils/_os.py b/django/utils/_os.py
index f7b279db24..2c7b88e2c3 100644
--- a/django/utils/_os.py
+++ b/django/utils/_os.py
@@ -30,17 +30,16 @@ def safe_join(base, *paths):
     The final path must be located inside of the base path component (otherwise
     a ValueError is raised).
     """
-    # We need to use normcase to ensure we don't false-negative on case
-    # insensitive operating systems (like Windows).
     base = force_unicode(base)
     paths = [force_unicode(p) for p in paths]
-    final_path = normcase(abspathu(join(base, *paths)))
-    base_path = normcase(abspathu(base))
+    final_path = abspathu(join(base, *paths))
+    base_path = abspathu(base)
     base_path_len = len(base_path)
-    # Ensure final_path starts with base_path and that the next character after
-    # the final path is os.sep (or nothing, in which case final_path must be
-    # equal to base_path).
-    if not final_path.startswith(base_path) \
+    # Ensure final_path starts with base_path (using normcase to ensure we
+    # don't false-negative on case insensitive operating systems like Windows)
+    # and that the next character after the final path is os.sep (or nothing,
+    # in which case final_path must be equal to base_path).
+    if not normcase(final_path).startswith(normcase(base_path)) \
        or final_path[base_path_len:base_path_len+1] not in ('', sep):
         raise ValueError('The joined path (%s) is located outside of the base '
                          'path component (%s)' % (final_path, base_path))