diff options
| author | Markus Holtermann <info@markusholtermann.eu> | 2015-03-31 15:47:06 +0200 |
|---|---|---|
| committer | Markus Holtermann <info@markusholtermann.eu> | 2015-04-11 21:12:09 +0200 |
| commit | 3862826fedc99378279b85e602079b53593ae129 (patch) | |
| tree | b7d0e8ad1bdbf55a1013f383cc9a3161454f59ec /tests/admin_docs/models.py | |
| parent | 774d09a7dd62a5a7c90343e08ea38bcb065ecf94 (diff) | |
[1.8.x] Fixed #24625 -- Prevented arbitrary file inclusion in admindocs
Thanks Tim Graham for the review.
Backport of 09595b4fc67ac4c94ed4e0d4c69acc1e4a748c81 from master
Diffstat (limited to 'tests/admin_docs/models.py')
| -rw-r--r-- | tests/admin_docs/models.py | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/tests/admin_docs/models.py b/tests/admin_docs/models.py index 7e8b6c37e8..89a9e8c98e 100644 --- a/tests/admin_docs/models.py +++ b/tests/admin_docs/models.py @@ -29,6 +29,12 @@ class Person(models.Model): Field storing :model:`myapp.Company` where the person works. (DESCRIPTION) + + .. raw:: html + :file: admin_docs/evilfile.txt + + .. include:: admin_docs/evilfile.txt + """ first_name = models.CharField(max_length=200, help_text="The person's first name") last_name = models.CharField(max_length=200, help_text="The person's last name") |