From b8ba73cd0cb6a3dbdaeb3df65936970956829de3 Mon Sep 17 00:00:00 2001 From: Aymeric Augustin Date: Tue, 11 Nov 2014 18:59:49 +0100 Subject: Raised SuspiciousFileOperation in safe_join. Added a test for the condition safe_join is designed to prevent. Previously, a generic ValueError was raised. It was impossible to tell an intentional exception raised to implement safe_join's contract from an unintentional exception caused by incorrect inputs or unexpected conditions. That resulted in bizarre exception catching patterns, which this patch removes. Since safe_join is a private API and since the change is unlikely to create security issues for users who use it anyway -- at worst, an uncaught SuspiciousFileOperation exception will bubble up -- it isn't documented. --- django/core/files/storage.py | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) (limited to 'django/core') diff --git a/django/core/files/storage.py b/django/core/files/storage.py index cff2d06f1a..7a9bc06665 100644 --- a/django/core/files/storage.py +++ b/django/core/files/storage.py @@ -277,11 +277,7 @@ class FileSystemStorage(Storage): return directories, files def path(self, name): - try: - path = safe_join(self.location, name) - except ValueError: - raise SuspiciousFileOperation("Attempted access to '%s' denied." % name) - return os.path.normpath(path) + return safe_join(self.location, name) def size(self, name): return os.path.getsize(self.path(name)) -- cgit v1.3