From 08f6e43575e79657cb1299d5f4c391821273f724 Mon Sep 17 00:00:00 2001
From: Matthias Kestenholz
Date: Mon, 13 Nov 2017 21:22:03 +0100
Subject: [PATCH 1/2] Refs #984: Disallow loading arbitrary files using the
template_source debugging view
---
debug_toolbar/panels/templates/panel.py | 3 +++
debug_toolbar/panels/templates/views.py | 5 +++++
debug_toolbar/templates/debug_toolbar/panels/templates.html | 2 +-
3 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/debug_toolbar/panels/templates/panel.py b/debug_toolbar/panels/templates/panel.py
index 7367cc153..ace5a6bd4 100644
--- a/debug_toolbar/panels/templates/panel.py
+++ b/debug_toolbar/panels/templates/panel.py
@@ -7,6 +7,7 @@
from django import http
from django.conf.urls import url
+from django.core import signing
from django.db.models.query import QuerySet, RawQuerySet
from django.template import RequestContext, Template
from django.test.signals import template_rendered
@@ -192,8 +193,10 @@ def generate_stats(self, request, response):
template = template_data.get('template', None)
if hasattr(template, 'origin') and template.origin and template.origin.name:
template.origin_name = template.origin.name
+ template.origin_hash = signing.dumps(template.origin.name)
else:
template.origin_name = _('No origin')
+ template.origin_hash = ''
info['template'] = template
# Clean up context for better readability
if self.toolbar.config['SHOW_TEMPLATE_CONTEXT']:
diff --git a/debug_toolbar/panels/templates/views.py b/debug_toolbar/panels/templates/views.py
index ac7cd3955..b458f1713 100644
--- a/debug_toolbar/panels/templates/views.py
+++ b/debug_toolbar/panels/templates/views.py
@@ -1,5 +1,6 @@
from __future__ import absolute_import, unicode_literals
+from django.core import signing
from django.http import HttpResponseBadRequest
from django.template import TemplateDoesNotExist
from django.template.engine import Engine
@@ -23,6 +24,10 @@ def template_source(request):
template_origin_name = request.GET.get('template_origin', None)
if template_origin_name is None:
return HttpResponseBadRequest('"template_origin" key is required')
+ try:
+ template_origin_name = signing.loads(template_origin_name)
+ except Exception:
+ return HttpResponseBadRequest('"template_origin" is invalid')
template_name = request.GET.get('template', template_origin_name)
final_loaders = []
diff --git a/debug_toolbar/templates/debug_toolbar/panels/templates.html b/debug_toolbar/templates/debug_toolbar/panels/templates.html
index d7bf6a622..0440dc349 100644
--- a/debug_toolbar/templates/debug_toolbar/panels/templates.html
+++ b/debug_toolbar/templates/debug_toolbar/panels/templates.html
@@ -14,7 +14,7 @@ {% blocktrans count templates|length as template_count %}Template{% plural %
{% if templates %}
{% for template in templates %}
-- {{ template.template.name|addslashes }}
+- {{ template.template.name|addslashes }}
- {{ template.template.origin_name|addslashes }}
{% if template.context %}
-
From 038c649eadbd4818c3d260cf1844c0cc5e837f5d Mon Sep 17 00:00:00 2001
From: Matthias Kestenholz
Date: Mon, 13 Nov 2017 22:12:37 +0100
Subject: [PATCH 2/2] Fix the template_source test
---
tests/test_integration.py | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tests/test_integration.py b/tests/test_integration.py
index 03d1f681a..fceb9ae4c 100644
--- a/tests/test_integration.py
+++ b/tests/test_integration.py
@@ -8,6 +8,7 @@
import django
from django.contrib.staticfiles.testing import StaticLiveServerTestCase
+from django.core import signing
from django.core.checks import Error, run_checks
from django.template.loader import get_template
from django.test import RequestFactory, TestCase
@@ -143,7 +144,7 @@ def test_template_source_checks_show_toolbar(self):
url = '/__debug__/template_source/'
data = {
'template': template.template.name,
- 'template_origin': template.template.origin.name
+ 'template_origin': signing.dumps(template.template.origin.name)
}
response = self.client.get(url, data)