1. Larry Hastings
  2. python-clinic

Commits

Barry Warsaw  committed 936621d

- Issue #16248: Disable code execution from the user's home directory by
tkinter when the -E flag is passed to Python. Patch by Zachary Ware.

  • Participants
  • Parent commits 4a17784
  • Branches 2.6

Comments (0)

Files changed (2)

File Lib/lib-tk/Tkinter.py

View file
  • Ignore whitespace
         self.tk = _tkinter.create(screenName, baseName, className, interactive, wantobjects, useTk, sync, use)
         if useTk:
             self._loadtk()
-        self.readprofile(baseName, className)
+        if not sys.flags.ignore_environment:
+            # Issue #16248: Honor the -E flag to avoid code injection.
+            self.readprofile(baseName, className)
     def loadtk(self):
         if not self._tkloaded:
             self.tk.loadtk()

File Misc/NEWS

View file
  • Ignore whitespace
 Library
 -------
 
+- Issue #16248: Disable code execution from the user's home directory by
+  tkinter when the -E flag is passed to Python.  Patch by Zachary Ware.
+
 
 What's New in Python 2.6.8?
 ===========================