Commit 7639e09f authored by Andreas Zeidler's avatar Andreas Zeidler

docutil's security restrictions are now applied using a monkey patch; this...

docutil's security restrictions are now applied using a monkey patch;  this way the upstream version of docutils can be used (i.e. an egg)
parent 4db2fa1a
##############################################################################
#
# Copyright (c) 2002 Zope Corporation and Contributors. All Rights Reserved.
#
# This software is subject to the provisions of the Zope Public License,
# Version 2.1 (ZPL). A copy of the ZPL should accompany this distribution.
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY AND ALL EXPRESS OR IMPLIED
# WARRANTIES ARE DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS
# FOR A PARTICULAR PURPOSE
#
##############################################################################
""" security patches for docutils """
try:
import docutils
except ImportError:
raise ImportError, 'Please install docutils 0.4.0+ from http://docutils.sourceforge.net/#download.'
version = docutils.__version__.split('.')
if not (version >= ['0', '4', '0'] or version >= ['0', '4']):
raise ImportError, """Old version of docutils found:
Got: %(version)s, required: 0.4.0+
Please remove docutils from %(path)s and replace it with a new version. You
can download docutils at http://docutils.sourceforge.net/#download.
""" % {'version' : docutils.__version__, 'path' : docutils.__path__[0] }
# disable inclusion of files for security reasons
# this way we don't need a custom version of docutils anymore
import docutils.parsers.rst.directives.misc
# additional import needed here since raw's func_code was swapped below...
from docutils import nodes
def include(*args, **kw):
""" disabled for security reasons """
raise NotImplementedError, 'File inclusion not allowed!'
docutils.parsers.rst.directives.misc.include.func_code = include.func_code
def raw_orig(*args, **kw):
""" place holder for original copy of function """
pass
raw_orig.func_code = docutils.parsers.rst.directives.misc.raw.func_code
docutils.parsers.rst.directives.misc.raw_orig = raw_orig
def raw(name, arguments, options, *args, **kw):
""" disabled specific options for security reasons """
if options.has_key('file') or options.has_key('url'):
raise NotImplementedError, 'File inclusion not allowed!'
return raw_orig(name, arguments, options, *args, **kw)
docutils.parsers.rst.directives.misc.raw.func_code = raw.func_code
...@@ -28,6 +28,9 @@ Please remove docutils from %(path)s and replace it with a new version. You ...@@ -28,6 +28,9 @@ Please remove docutils from %(path)s and replace it with a new version. You
can download docutils at http://docutils.sourceforge.net/#download. can download docutils at http://docutils.sourceforge.net/#download.
""" % {'version' : docutils.__version__, 'path' : docutils.__path__[0] } """ % {'version' : docutils.__version__, 'path' : docutils.__path__[0] }
# monkey patch docutils for security reasons
import docutilsSecurityPatches
import sys, os, locale import sys, os, locale
from App.config import getConfiguration from App.config import getConfiguration
from docutils.core import publish_parts from docutils.core import publish_parts
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment