Commits

Anonymous committed e09c0f7

0.90-fixes: Fixed minor security hole in compile-messages.py. See trunk patch in [3592]

  • Participants
  • Parent commits c46d462
  • Branches 0.90-bugfixes

Comments (0)

Files changed (1)

File django/bin/compile-messages.py

         if file.endswith('.po'):
             sys.stderr.write('processing file %s in %s\n' % (file, dirpath))
             pf = os.path.splitext(os.path.join(dirpath, file))[0]
-            cmd = 'msgfmt -o %s.mo %s.po' % (pf, pf)
+            # Store the names of the .mo and .po files in an environment
+            # variable, rather than doing a string replacement into the
+            # command, so that we can take advantage of shell quoting, to
+            # quote any malicious characters/escaping.
+            # See http://cyberelk.net/tim/articles/cmdline/ar01s02.html
+            os.environ['djangocompilemo'] = pf + '.mo'
+            os.environ['djangocompilepo'] = pf + '.po'
+            cmd = 'msgfmt -o "$djangocompilemo" "$djangocompilepo"'
             os.system(cmd)